Microsoft is the half of business email that cold-email tools treat as an afterthought. Microsoft 365 mailboxes carried 33% of the cold email Saleshandy tracked in H1 2026, against 44% for Google Workspace (vendor data). On the solo end, the Gmail-native tool GMass is an estimated $8.6M business with about 11 staff (Latka estimate), and nobody owns the Outlook equivalent.
There is also a dated forcing event. Exchange Online's Basic SMTP AUTH becomes disabled by default for existing tenants at the end of December 2026, with final removal to be announced in the second half of 2027 (MC786329, updated 27 Jan 2026). After that, clients get a permanent "550 5.7.30 Basic authentication is not supported for Client Submission".
The opening
Three overlapping openings sit behind "Microsoft-first":
- The migration. Any sender or infra vendor connecting Microsoft inboxes with Basic SMTP AUTH has to move to OAuth (
SMTP.Send) or GraphsendMailwithin months. Admins can re-enable Basic for now, but the direction is set. See OAuth verification and the end of basic auth. - "GMass for Outlook". A mail-merge and follow-up tool that lives in the Outlook client and sends from the user's own mailbox. GMass shows the Gmail version supports a profitable business at $20–49/month annual (GMass).
- The safer volume base. Microsoft cancelled its planned 2,000-external-recipients-per-mailbox limit in January 2026. The per-mailbox ceiling stays at 10,000 recipients a day. The tenant limit scales with licences: 10,000/day for 1 licence, 22,059 for 100. See Microsoft rules: Outlook.com and Microsoft 365 limits.
The integration economics favour Microsoft. Publisher verification is free. Reading Gmail needs restricted scopes and an annual CASA assessment, priced at $3,000–6,000 a year at one lab. This research found no comparable paid assessment for Graph mail permissions (OAuth verification and the end of basic auth).
No source in this research gives the share of European corporate recipients or senders on Microsoft 365 versus Google Workspace. "European SMBs are Microsoft shops" is a widely held belief, not a measured fact here. Size the market with customer interviews before building the add-in.
Who pays and how much
| Buyer | What they pay today (Oct 2026) | Source |
|---|---|---|
| Gmail solo sender | GMass $29.95–59.95/mo monthly | GMass |
| CRM-seat sender | HubSpot Sales Hub Pro seat ~$90–100/mo; sequences capped at 500/day per Pro seat | HubSpot, HubSpot KB |
| Microsoft cold infra buyer | $50/domain/mo for 25 mailboxes (ScaledMail); $25/domain (Hypertide Entra); $30/tenant up to 100 mailboxes (InboxKit) | ScaledMail, Hypertide, InboxKit |
An Outlook add-in would price like GMass. The migration tool is a one-off or free acquisition hook. The value of a Microsoft-first engine shows up inside the other openings, not as its own line.
Why incumbents have not closed it
- The volume sequencers are Google-first. Instantly's pre-warmed accounts are Google only, and its DFY inboxes are Google only, US IPs. Microsoft arrives through resellers (Smartlead SmartSenders via Zapmail and InfraInbox).
- GMass is Gmail by design and has shown no sign of an Outlook push (GMass).
- The suites cap volume. HubSpot runs on the rep's connected mailbox with 500/1,000 sequence emails a day per seat. Outreach and Salesloft are per-seat at $100+ (Governed volume for sales teams).
What is not a gap: connecting Outlook mailboxes to a sequencer. Every major sequencer does it, and ESP matching already routes Outlook to Outlook.
What you would build first
- A migration checker and reconnect flow. Scan connected Microsoft inboxes for Basic SMTP AUTH or app-password use and reconnect them via OAuth in bulk, with tenant-admin consent in one step. Offer it free to infra vendors' customers before the December default-off.
- A Graph-native sender.
sendMailreturns 202 Accepted, which is not delivery. Reconcile against Sent Items. Use change-notification subscriptions, which expire in under 7 days, with a fallback poll. See Sending architecture. - An Outlook add-in for mail merge from Excel or a CRM list, follow-ups stopped on reply, and German, French and Dutch UI from day one.
- Tenant-aware reporting. Microsoft 365 filtering varies per recipient tenant, because each tenant can move its bulk complaint threshold. Report results by recipient domain.
How the leaders would respond
The migration window is short and any sequencer can ship an OAuth reconnect flow, so the hook will be matched fast. Which incumbents still rely on Basic SMTP AUTH for Microsoft inboxes is not documented in this research. GMass could port to Outlook if demand appeared. Microsoft itself is the bigger variable: it promised "smarter, more adaptive approaches" to outbound limits with no date, and it states that bulk mail through Microsoft 365 is permitted only "on a 'best-effort' basis".
Scores, argued
Pain: 3. The December 2026 change is a hard deadline for senders still on Basic SMTP AUTH, and Microsoft 365 users have no GMass. But most volume senders already connect via OAuth, and Outlook-only users are not complaining loudly in the record.
Gap: 3. No Outlook-native mail-merge leader and Google-first DFY infra at the leaders are real gaps. Outlook connectivity inside sequencers is not.
Size: 2. The GMass analogue suggests a high-margin business in the high single-digit millions. The migration is one-off. Unless European corporate tenants prove a larger pool, this is a niche.
Moat: 2. Graph is well documented, publisher verification is free, and add-in distribution is open to anyone.
Speed: 4. No CASA, free verification and a documented API mean weeks to a working sender. The add-in store review adds some time.
Safety: 4. Microsoft's limits are documented and the ERR cancellation removed the main threat. Low-volume sending from users' own mailboxes is low-risk. Microsoft's promised "adaptive" controls keep this from a 5.
What would kill it
Microsoft postpones the Basic SMTP AUTH default-off again, as it already did from March–April 2026 (MC786329), which removes the urgency. Or Microsoft ships its "adaptive" outbound limits and specifically targets mass-provisioned tenants, which would hurt the volume use of Microsoft infra, though not the own-mailbox add-in.
What this means for an entrant
- Make Graph your first connector, not your second. It is cheaper to verify than Gmail, has predictable limits, and is the safer volume base in 2026 (Provider crackdowns). Ship Google send-only first and earn the CASA letter while revenue builds.
- Use the December deadline as a marketing moment. A free "is your Microsoft sending going to break?" checker gets you in front of agencies running Microsoft infra.
- Stack it with EU-native compliant outbound. If interviews confirm that European SMB and mid-market buyers run Microsoft 365, an EU-hosted, Graph-first, German-language sender is a coherent pitch. Verify first; the data gap is real.
- Stack it with Signal-triggered sequencer and Governed volume for sales teams. Corporate SDR teams send from their own Microsoft 365 mailboxes at low volume. That is where Graph matters most.
- Do not build on tenant stuffing. Cheap Microsoft domains with 25 mailboxes each are the pattern Microsoft's adaptive controls will look for first (Infrastructure strategy: build or partner).