MS Exchange: How to enable SMTP to use OAUTH2.0 but with basic AUTH disabled

I had this exact same problem and the issue turned out to be that I was trying to authenticate using the Administrator account. As soon as I tried a non-administrative user account it started working perfectly.

Possibly related information: http://www.apijunkie.com/APIJunkie/blog/post/2007/11/SMTP-535-573-Authentication-unsuccessful-error-on-Exchange-server-2003.aspx

That page no longer exists. Its content, using the Way Back Machine is copied here for reference:

If you receive this error and have exhausted all other recommended options from Microsoft and other sources on the web then you might have stumbled upon the same unknown exchange feature/bug that we suffered from.

After doing some digging around it seemed that when we installed exchange it did not set permissions properly on some of the existing users. So some users could not authenticate against the SMTP server even though it seemed like they had the exact same permissions and SMTP settings as other users that could authenticate.

To solve the problem we had to create new user accounts. New user accounts did not receive the same SMTP error.

To test if you suffer from the same problem just try to create a new domain user account and assign an exchange profile/email address to it. If this user is able to authenticate through SMTP then you found your culprit.

How about putting your SMTP AUTH on another port like 587, and using iptables to restrict access to that port? 587 isn't a hidden port, it's an RFC defined mail submission port. Mail to you arrives on 25, mail through you needs to go over 587.

https://www.rfc-editor.org/rfc/rfc6409