Implementing Microsoft 365 OAuth 2.0 for SMTP on AKCP sensorProbe+

Dear valued customer,

Yes, we recently (October 2026) added the support for the MS AOuth 365 SMTP email into the SP+ base units firmware.

Here is the step-by-step guide to implementing Microsoft 365 OAuth 2.0 for SMTP on your AKCP sensorProbe+ (SP+ / SP2+ / SPX+ / SP1+ / SP-WTS) series devices.

Because the SP+ authenticates using the OAuth 2.0 Device Code Flow as a Public Client, both your Microsoft Entra ID (Azure AD) App Registration and the SP+ network/time settings must be configured in a specific way so Microsoft accepts the token request.

Phase 1: Check Your Hardware Platform & Upgrade Firmware

OAuth 2.0 SMTP support requires an H7 device with firmware  v1.0.6299 or newer. Before upgrading, please check your device’s About page in the Web UI to confirm whether your unit uses the H7 or F7 hardware platform:

• For SP+ H7 Platform Units:
• Option 1 — Latest Firmware v1.0.6501 (Sept/Oct 2026): Download: http://www.akcp.in.th/downloads/SP2%2B/spplus_h7-1.0.6501_20260918.zip

(CRITICAL NOTE: Firmware v1.0.6501 permanently removes the VPN and AKCPro Cloud Server (CloudAPS) features to free up system memory. Do NOT upgrade to 1.0.6501 if you use CloudAPS or remote APS over VPN).

• Option 2 — Firmware v1.0.6299 (July 2026): Download: http://www.akcp.in.th/downloads/SP2%2B/spplus-h7-1.0.6299_20260715.zip

(Includes improved Microsoft OAuth 2.0 token refresh handling while retaining VPN and AKCPro Cloud Server support).

• For Legacy SP+ F7 Platform Units: OAuth is not supported.

(Note: If you are using an older AKCP platform such as a securityProbe 5ES (SEC5ES) or AKCPro Server (WinAPS) on Windows, please let note that OAuth is not supported).

Phase 2: Microsoft Entra ID (Azure AD) App Registration Setup

Log in to the Microsoft Entra Admin Center (https://entra.microsoft.com) and configure your App Registration as follows:

1. Create or Select Your App Registration:

• Navigate to Identity -> Applications -> App registrations.
• Click + New registration (or select your existing AKCP app), give it a name (e.g., AKCP-SMTP-OAuth), select Accounts in this organizational directory only (Single tenant), and click Register.
• Copy the Application (client) ID and Directory (tenant) ID from the Overview page—you will need these on the SP+ Web UI.

2. Configure API Permissions (Must be Delegated SMTP.Send):

• Go to API permissions.
• If SMTP.SendAsApp (Application permission) is present, remove it.
• Click + Add a permission -> APIs my organization uses, search for and select Office 365 Exchange Online.
• Select Delegated permissions, search for Send, check the box, and click Add permissions.
• (Note: User.Read under Microsoft Graph is also normally present by default).
• Click Grant admin consent for [Your Organization] and confirm that the status shows a green checkmark.

3. Enable Public Client Flows:

• Go to Authentication on the left menu and scroll down to Advanced settings.
• Set Allow public client flows (“Enable the following mobile and desktop flows”) to Yes and click Save.

4. Remove Any Client Secrets:

• Go to Certificates & secrets -> Client secrets.
• Ensure there are no active Client Secrets attached to this App Registration (delete any existing secrets). If a Client Secret exists on the app, Microsoft will reject the Device Code Flow request with error AADSTS7000218.

5. Verify Mailbox SMTP Auth Setting:

• In the Microsoft 365 Admin Center (Users -> Active users -> [Target Sender Email] -> Mail -> Manage email apps), verify that Authenticated SMTP is checked/enabled for the sender mailbox you plan to use.

Phase 3: SP+ Network, Time & OAuth Configuration

Log in to your SP+ Web UI as admin and complete these steps in order:

1. Verify Network & DNS Settings:

• Go to Settings -> Network and verify that your IPv4 Address, Subnet Mask, and Default Gateway are all valid and in the same IP range.
• Populate all 3 DNS Server fields (e.g., your internal DNS plus 8.8.8.8 / 1.1.1.1) so the unit can reliably resolve login.microsoftonline.com and smtp.office365.com during periodic token refreshes.
• If you are not using VPN or AKCPro Cloud Server, ensure both are disabled so they do not conflict with outbound OAuth routing.

2. Enable Continuous NTP Time Sync:

• Go to Settings -> Date / Time (or NTP), set NTP to Continuously with valid NTP servers, and click Save. (Accurate system time is mandatory for Microsoft TLS certificate and OAuth token validation).

3. Configure SMTP Settings:

• Go to Settings -> SMTP.
• Configure the server for Microsoft 365 (smtp.office365.com, Port 587, Connection Security: STARTTLS).
• Enable the OAuth
• Enter the Microsoft 365 Sender Email Address, Tenant ID, and Client ID from Phase 2, then click Save.
• (Security Note: Tenant ID and Client ID are public identifiers. Once authorized, the actual OAuth Access Token is stored strictly in the device’s internal memory and is never exported in backup or support files).

4. Authorize the Device via Microsoft Device Login:

• Go to Settings -> OAuth in the SP+ Web UI and click Reauthorize.
• The SP+ will display a one-time User Code and the Microsoft verification URL.
• Open a new browser tab, navigate to https://microsoft.com/devicelogin, and enter the displayed code.
• Sign in using the exact Microsoft 365 mailbox credentials (and complete MFA if prompted) for the sender email account you configured in the SMTP settings.

5. Verify Token Status & Test Email:

• Return to the SP+ Web UI and refresh the Settings -> OAuth
• Confirm that both Access Token and Refresh Token display Active.
• Go to the Notification> Action page and run a Test Email to confirm delivery.

If you encounter any issues during setup, please send us (support@akcp.com) the complete details including the Support File from the SP+ unit (Settings -> Maintenance -> Download Support File) so we can check the internal logs and assist you further.

Best regards,

AKCP Support Team