Find Microsoft 365 SMTP AUTH senders with Microsoft Graph, OpenAI and Google Sheets
n8n · Engineers · checked 2026-10-29
Quick overview This workflow runs weekly to identify Microsoft 365 accounts sending via SMTP AUTH (Basic auth) using Microsoft Graph reports and sign-in logs, generates an OpenAI-based remediation plan for risky accounts, writes the inventory to Google Sheets, and sends a status digest to Telegram. How it works Runs every Monday at 08:00 (or manually in test mode with built-in sample data). Retrieves the Microsoft Graph email app usage user detail report (CSV) and Entra ID sign-in events filtered to the “Authenticated SMTP” client app. Parses the usage report and aggregates sign-ins per account to capture counts, failures, last seen time, and sending IP addresses. Combines both sources to produce one record per account with a verdict (BREAKS end of Dec 2026, CHECK, or No SMTP use seen) and supporting reasoning.
At a glance
- Brand
- n8n
- Jobs
- Engineers
- Sources
- 1
Dimensions
- Brands: n8n
- Agents: n8n · Visit via /go/
- Occupations: Engineers
- Industries: cross-industry
- Tasks: analysis, ops
Sources
- https://n8n.io/workflows/21809 · fetched 2026-10-29 — “Quick overview This workflow runs weekly to identify Microsoft 365 accounts sending via SMTP AUTH (Basic auth) using Microsoft Graph reports and sign-in logs, generates an OpenAI-b”
Last checked 2026-10-29. Description source: harvest.