SMTP App failed to send email due to OAuth authentication failure

Available Languages

Updated:October 1, 2026
Document ID:SPLK052423

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk SOAR SMTP App(5847) configured with OAuth authentication

Description

"Send email" action of SMTP App (5847)  failed with message below:

"message" : "Authentication failed for connecting to server with OAuth authentication. Message: Unable to get refresh token. Please run Test Connectivity again.. Please run test connectivity first."

Investigation

  1. Investigated in spawn.log and it was found that there was "Encrypting the access token" only when running test connectivity. 
  2. Checked the asset configuration and microsoft "Oauth2/v2.0" was found in "auth_url" and "token_url".
  3. On the Microsoft identity platform (requests made to the v2.0 endpoint), the App must explicitly request the offline_access scope, to receive refresh tokens.   the-offline_access-scope

Resolution

Add offline_access into the scope of asset configuration.

Revision History

Revision Publish Date Comments
1.0
01-Oct-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

Related Articles