Microsoft 365环境下IMAP认证正常但SMTP认证失败问题排查

背景 #

我正在为告警系统创建automation@mydomain.com邮箱账户，因Microsoft 365已弃用基本认证，采用现代认证方案：使用最新MSAL库完成认证，采用推荐的MailKit库处理邮件收发。

代码实现目标 #

代码需完成以下4项操作：

• 从文件读取证书
• 通过证书向Microsoft获取认证令牌
• 基于IMAP连接目标收件箱并读取邮件数量，验证令牌与配置有效性
• 发送告警邮件

代码示例 #

Dim AuthCert = New X509Certificate2(CertPath, EmailSettings("AuthCertPassword"), X509KeyStorageFlags.PersistKeySet)

AuthClient = ConfidentialClientApplicationBuilder.Create(EmailSettings("ApplicationID")).
                                                    WithAuthority(AzureCloudInstance.AzurePublic, EmailSettings("TenantID")).
                                                    WithCertificate(AuthCert).
                                                    Build

Dim AuthResult = AuthClient.AcquireTokenForClient({"https://outlook.office365.com/.default"}).ExecuteAsync.Result

Dim EmailMessage As New MimeMessage
EmailMessage.From.Add(New MailboxAddress(Nothing, Config.EmailSenderAddress))

For Each R In Config.EmailRecipients
    EmailMessage.To.Add(New MailboxAddress(Nothing, R))
Next

EmailMessage.Body = New TextPart("plain") With {.Text = Warning}

Using MailClient As New ImapClient
    MailClient.Connect("outlook.office365.com", 993, SecureSocketOptions.SslOnConnect)
    Log.WriteEntry($"Token length is: {AuthResult.AccessToken.Length}")
    Dim Authentication As New SaslMechanismOAuth2(Config.EmailSenderAddress, AuthResult.AccessToken)
    MailClient.Authenticate(Authentication)
    MailClient.Inbox.Open(MailKit.FolderAccess.ReadOnly)
    Log.WriteEntry($"IMAP worked. Inbox count is {MailClient.Inbox.Count}")
    MailClient.Disconnect(True)
End Using

Using MailClient As New SmtpClient
    MailClient.Connect("smtp.office365.com", 587, SecureSocketOptions.StartTls)

    Dim Authentication As New SaslMechanismOAuth2(Config.EmailSenderAddress, AuthResult.AccessToken)

    MailClient.Authenticate(Authentication)
    MailClient.Send(EmailMessage)
    MailClient.Disconnect(True)
End Using

当前运行状态 #

• 读取证书文件 ✔
• 获取有效认证令牌 ✔
• 通过IMAP连接并读取收件箱邮件数量 ✔
• 通过SMTP发送邮件 ✖

错误详情 #

MailKit.Security.AuthenticationException: 535: 5.7.3 Authentication unsuccessful [BN9PR03CA0500.namprd03.prod.outlook.com 2023-01-26T16:58:30.103Z 08DAFF3B69EFD03B]

错误触发于SMTP代码段的MailClient.Authenticate(Authentication)行，但同一认证信息在IMAP连接时可正常通过。

已完成的Microsoft 365配置 #

• 已注册Azure AD应用并配置IMAP、SMTP所需的API权限，确认MailKit库已实现SASL XOAUTH2功能
• 组织级SMTP AUTH已禁用，通过Set-CASMailbox命令单独为automation@mydomain.com启用了已验证客户端SMTP提交
• 已创建服务主体，并通过Add-MailboxPermission命令赋予其该邮箱的访问权限

疑问 #

请问还遗漏了哪些配置或操作步骤？

内容的提问来源于stack exchange，提问作者Keith Stein