Microsoft (Outlook.com and Microsoft 365) · permanent error
535 5.7.144: HVE: app lacks the right API permissions
The OAuth token came from an app registration whose API permissions do not allow it to use HVE, so authentication failed.
- Microsoft
- Provider
- Permanent (5xx)
- Class
- Sources checked
- Author
At a glance
- Code
- 535 5.7.144
- Temporary or permanent
- PermanentRefused for good: the message comes back to the sender, and resending it gets the same answer.
- Who has to act
- The sender. The fix is on the sending side: your domain, your server or your list.
- What the server says
535 5.7.144 XOAUTH2 authentication failed. Invalid API permissions.
What it means
To use HVE with OAuth, the app registered for it needs the right API permissions. If the token it presents carries the wrong permissions, Exchange Online rejects authentication with 535 5.7.144. Retrying will not help; an admin has to check the permissions configured for the app and update them as needed, after which the application should request a new token that reflects the change.
Common causes
- The app registration lacks the API permission HVE requires.
- Permissions were changed but the application still uses a token issued before the change.
How to fix it
- 01Admins: check the app's API permissions against Microsoft's guide to using OAuth with High Volume Email.
- 02Update the permissions, granting admin consent if your directory requires it.
- 03Have the application request a new token and authenticate again.
Sources
What this page rests on, checked on 20 Oct 2026. The explanation is ours; the reply text is the server's.
- Email nondelivery reports and SMTP errors in Exchange Onlinelearn.microsoft.com
Related codes
Further reading
All 111 Microsoft codesEvery code in the wikiPaste your own bounce