A potential client finds your website, fills in the contact form and clicks Send. The page says “Thanks, we’ll be in touch.” And then nothing happens, because the email never reached you.
It’s more common than most business owners realise, and it’s silent. The website looks fine, the form looks fine, and you only notice when someone phones to ask why you never replied. Or worse, they don’t phone, and go to a competitor instead.
If your business email runs on Microsoft 365, there’s a good chance your website is affected or soon will be. Here’s why, and how to fix it properly.
Why it happens
Your website can’t send email by itself. It has to log in to an email account, usually your business mailbox, and send through that.
For years, the standard way to do that was simple: type the mailbox’s username and password (or a special “app password”) into the website’s settings. It worked, but it meant a password to your business email sat inside your website, where anyone who broke into the site could find it.
Microsoft has been closing that door. Its security settings now block this older style of login by default, and Microsoft is phasing it out altogether. So a website that has sent emails happily for years can suddenly stop, and nobody gets told.
The fix: a proper, approved connection
The modern way works a lot like “Sign in with Microsoft” on other websites. Instead of storing a password, your website is registered with your Microsoft 365 account as an approved app. Your administrator approves it once, and it’s only allowed to do one thing: send email.
From then on, the website gets a short-lived digital pass from Microsoft every time it needs to send. Microsoft renews the pass automatically in the background, so nobody has to type anything in again.
Here’s what happens when someone submits your contact form: How an enquiry reaches your inbox
The same connection covers every email your website sends: contact forms, online order confirmations, password resets and notifications. It also works with shared mailboxes, so enquiries can arrive in a general address like info@ that the whole team can see.
Why it’s better
- No password on your website. If your site were ever hacked, there’s no email password sitting there to steal.
- It can only send. The approval is limited to sending email. It can’t read your inbox or touch anything else in Microsoft 365.
- You stay in control. The approval lives in your Microsoft 365 admin settings, and it can be switched off at any time without changing anyone’s password.
- It keeps working. It uses the method Microsoft supports going forward, so it won’t break the next time Microsoft tightens security.
The one thing to remember. The approval comes with a security key that expires, typically after two years. When it does, emails quietly stop sending again. The fix takes a few minutes, as long as someone knows it’s coming. Put a reminder in the calendar a couple of months before it’s due. Or let us keep track of it for you.
A two-minute test you can do today
- Open your own website on your phone and fill in the contact form, as if you were a customer.
- Wait five minutes and check the inbox it should arrive in.
- Check the junk or spam folder too.
If it arrived in your inbox, great. If it landed in junk, or didn’t arrive at all, your enquiries are at risk, and it’s worth fixing before you miss the next one.
Want it sorted?
We’ll check how your website sends email, switch it to a secure, approved connection with your Microsoft 365 account, and test every form so you know enquiries are getting through. It’s a quick job, and nobody needs to change their password.
Get your website’s email checked, or see our web design and hosting services.
