Do I really need PowerShell for SMTP OAuth in Microsoft 365?

It depends on the OAuth flow. Creating an app registration and setting its API permissions and credentials can be done in the Entra admin portal. That part is separate from configuring the app to authenticate to SMTP and request a token.

For app-only SMTP access, there can be an extra Exchange setup step: registering the application’s service principal in Exchange and granting it access to the mailbox. That part is commonly done with Exchange PowerShell, and granting broad mailbox access may not be the right permission for every setup. Check the requirements for the specific flow and permission your vendor uses.

Short version: PowerShell isn’t needed just to create the OAuth app, but the portal may not cover all the Exchange-side authorization you need for app-only SMTP. If your setup needs an Exchange service principal and mailbox-specific permissions, expect to use Exchange PowerShell.

Also, an app registration alone doesn’t make SMTP work. The application still needs to obtain an access token and use it for SMTP OAuth authentication. Graph is a separate way to send mail, not the SMTP authentication step.

Ask the vendor which OAuth flow it supports before building the configuration. Delegated access and app-only access have different permission and mailbox setup requirements, so a generic “OAuth supported” checkbox doesn’t tell you enough.

If the vendor supports delegated access, its client may handle the sign-in and token process. If it needs app-only access, confirm exactly which Exchange permissions and service-principal setup it expects. That’s where PowerShell may be part of the job, even though app registration itself is portal-friendly.

I’d treat PowerShell as an Exchange configuration tool here, not as a requirement for OAuth itself. The portal can handle the app registration, but SMTP app-only authorization can involve Exchange-specific setup that isn’t all exposed in the admin center.

Before granting anything, verify the requested permission and scope with the vendor. Don’t assume that a broad mailbox permission is required just because one setup guide mentions it.