Microsoft 365 "554 5.2.0 STOREDRV.Submission.Exception:SendAsDeniedException": how to fix it

What it means

This error comes from your own Microsoft 365 organization, not from the recipient. You tried to send an email with a From address that the signed-in account is not allowed to use. The message usually looks like this:

554 5.2.0 STOREDRV.Submission.Exception:SendAsDeniedException.
MapiExceptionSendAsDenied; Failed to process message due to a permanent
exception with message Cannot submit message.

In Outlook you may receive it as an undeliverable report saying "You can't send a message on behalf of this user unless you have permission to do so".

Why it happens

Microsoft 365 checks that the account that logs in to send has the right to use the address in the From field. It refuses when:

• You send from a shared mailbox or another person's address, without Send As or Send on Behalf permission.
• The permission was just added and has not reached all servers yet.
• Outlook keeps an old From address in its autocomplete list, pointing to a removed mailbox or alias.
• A printer, scanner, website or script logs in with one account (SMTP authentication) but puts a different address in From, such as scanner@yourdomain.com or noreply@yourdomain.com.
• An application (CRM, ERP, ticket system) sends on behalf of users through a service account without permissions.

How to check

• Compare the two addresses: the account used to sign in (in the app or device settings) and the From address. If they differ, permission is needed.
• Check the mailbox permissions in the Exchange admin center: open the mailbox used in From, then its delegation settings, and look at Send As and Send on Behalf.
• Test the device or app with Delivmail: once fixed, send an email from it to the unique address on the Delivmail home page (/). If it arrives, sending works, and the report also shows whether SPF, DKIM and DMARC pass.

How to fix it

1. Grant the right permission. In the Exchange admin center, open the mailbox (for example the shared mailbox), go to delegation and add the user under Send As (the email looks like it was sent by the mailbox) or Send on Behalf (shown as "user on behalf of mailbox"). In PowerShell:

   Add-RecipientPermission -Identity shared@yourdomain.com -Trustee user@yourdomain.com -AccessRights SendAs

2. Wait for the change. Permissions can take up to an hour to apply. Restart Outlook afterwards.
3. Clear the old From address in Outlook. Remove the address from the autocomplete suggestions and type it again, or select it from the address book.
4. Fix devices and scripts. Set the From address to the same address as the account used to log in, or give that account Send As permission on the From address. For printers and scanners that cannot authenticate properly, Microsoft documents other options such as direct send or an SMTP relay connector.
5. Check the address still exists. If the mailbox or alias was deleted, use a current address instead.

Check that it is fixed

Send the email again from the same user, app or device. For automated systems, send to a new Delivmail test address first: if it arrives, the permission problem is solved, and you can check that the new From address is also authenticated with SPF, DKIM and DMARC before sending to real recipients.