Sending Emails from Accfin Sky Using Microsoft 365
Sending Emails from Accfin Sky
Using Microsoft 365
A plain-language guide for clients and Microsoft 365 administrators
|
The main point
Accfin Sky can send email through your Microsoft 365 account. However, a Microsoft setting called Security Defaults blocks the type of email connection currently used by Sky. If Security Defaults remains switched on, Microsoft will reject the connection — even when the username, password and server settings are correct.
|
This is a Microsoft 365 security restriction. It is not a fault in Accfin Sky and does not affect the rest of the system.
1. What needs to be changed?
A person who administers your Microsoft 365 account must make the following changes:
Turn off Security Defaults in Microsoft Entra ID.
Allow SMTP AUTH for the Microsoft 365 organisation, where required.
Allow Authenticated SMTP for the specific mailbox that Accfin Sky will use.
Provide Accfin with the mailbox and email-server connection details.
Why is this necessary? Microsoft does not allow SMTP AUTH while Security Defaults is enabled. Sky therefore cannot connect directly to the mailbox until the setting is changed.
Where the administrator makes the change
|
Microsoft Entra Admin Centre → Entra ID → Overview → Properties
→ Manage Security Defaults → Disabled
|
The change must be made by someone with the correct Microsoft Entra administrator rights.
2. Can multi-factor authentication still be used?
Yes. Turning off Security Defaults does not mean that the organisation must stop using multi-factor authentication (MFA). It only means that Microsoft’s standard, all-in-one security setting is no longer being used.
The organisation can still protect users and administrators by setting up MFA separately through Microsoft Entra Conditional Access or other Microsoft security controls.
Where the organisation has the required Conditional Access licence, it can:
Require MFA for administrators and ordinary users.
Apply stronger rules to accounts with higher access rights.
Limit access according to location, device or sign-in risk.
Exclude the dedicated Accfin Sky email account from interactive MFA rules that would block SMTP authentication.
3. Which email account should be used?
It is best to use a dedicated system email account for Accfin Sky, rather than an employee’s normal work mailbox.
|
Recommended example: skyemail@yourcompany.co.za
|
The dedicated account should:
Have a strong, unique password.
Only have the permission needed to send email.
Not have administrator rights.
Be monitored for unusual sign-ins and email activity.
Not be used for unrelated work outside Accfin Sky.
4. What if the client does not want to turn off Security Defaults?
The alternative is for the client’s IT administrator to set up an SMTP relay or an Exchange Online connector in the client’s own Microsoft 365 environment.
In simple terms, the relay acts as a controlled middle point. Accfin Sky sends the email to the relay, and the relay then sends it through Microsoft 365. This allows Security Defaults to remain switched on.
The client is responsible for setting up and maintaining the relay. Once it is ready, the client must give Accfin the following details:
Relay server name.
Port number.
Encryption method.
Authentication details, if required.
Approved sender address or addresses.
5. The two available choices
|
Choice
|
What the client must do
|
Security Defaults
|
|
Direct Microsoft 365 connection
|
Turn off Security Defaults and enable Authenticated SMTP for the mailbox used by Sky.
|
Must be turned off.
|
|
Client-managed SMTP relay
|
Set up and maintain an SMTP relay or connector, then give the connection details to Accfin.
|
May remain on.
|
|
Important clarification
Turning off Security Defaults does not change how Accfin Sky works. It simply allows Microsoft 365 to accept the authenticated email connection required by Sky. MFA and other security controls can still be applied separately to the organisation’s users and administrators.
|
