Set up OTP login

CompanyWizard signs users in with a one-time passcode (OTP): the code is sent by email. This requires working SMTP delivery. The sign-in flow from the user’s perspective is shown in First login.

Configuring SMTP

In the SMTP section of the System settings you maintain: Server (host), Port, Use SSL/TLS, Sender address, and, if needed, Username and Password. A test mode with a test recipient helps with verification.

Alternatively via appsettings/environment (keys Smtp:SmtpServer, Smtp:SmtpPort, Smtp:SmtpUseSsl, Smtp:SmtpEmailFrom, Smtp:SmtpUserName, Smtp:SmtpPassword). → Environment variables & appsettings

Microsoft 365 (Exchange Online) without a password

Microsoft is retiring password sign-in (Basic Auth) for smtp.office365.com: from the end of December 2026 it is off by default in existing tenants, and it goes away for good in 2027. If you send through Exchange Online with a username and password today, sending stops then – and with it the sign-in. The SMTP section warns about exactly this setting.

There are two ways forward:

1. Send through a Microsoft 365 mailbox (recommended, no password):

   1. Under Admin → Mail Accounts, create a mailbox with protocol “Microsoft 365 (Exchange Online)”, enter its mailbox address and choose “Connect with Microsoft”. → Mailboxes with Microsoft 365
   2. In System settings → SMTP, under Send system mail via, choose “Microsoft 365 mailbox” and pick the mailbox.
   3. “Test connection” – it checks the connection and the send permission without sending a mail. Then “Save”.

   The sender is the mailbox’s address. For a shared mailbox the connected Microsoft account needs “Send As” or “Send on Behalf” on it (Exchange admin center → Mailboxes → Delegation). That can only be checked by the first real send; if it is missing, the reason shows in the SMTP section’s status.

2. SMTP relay service (e.g. a mail delivery provider, or an Exchange connector with a fixed IP address): enter it as a normal SMTP server. The retirement does not affect it.

The mailbox now carries the sign-in

While a mailbox sends the system mail, it cannot be deleted, disabled or switched to another protocol – change the sending route first. If the mailbox’s Microsoft sign-in expires (password change, revoked consent), no sign-in codes arrive any more; the status in the SMTP section turns red. Escape hatch: Smtp__IgnoreDatabaseSettings=true in the environment together with an SMTP configuration there – then the environment values apply, the sending route included.

Health check

At startup and after every save, an SMTP health monitor checks the connection and login. The result (time of the last check, errors if any) is shown in the tab – so you can spot misconfigurations before users can no longer sign in. When sending through a Microsoft 365 mailbox, every mail sent also updates the status.

Limits & notes

• Requires the Administrator role.
• SMS OTP is provided for in the code but currently not active – in production the email variant is used.
• The SMTP password is stored encrypted and never shown in plain text.
• In server/web operation, a reachable SMTP service is mandatory for login.

Related

• First login (OTP)
• Admin tab: System settings