What is High Volume Email in Exchange Online, and how do you set it up?

High Volume Email (HVE) is Microsoft's answer to a common problem: line-of-business apps, monitoring tools and printers that need to send a lot of mail to staff without borrowing a user's mailbox. It has clear limits, its own sign-in endpoint and usage-based billing. This guide covers what it does, what it can't do, and how to set it up and troubleshoot it, as documented at the time of writing (October 2026).

What is High Volume Email in Exchange Online?

High Volume Email is an Exchange Online sending service for automated, internal mail. Microsoft describes it as a way for "applications and devices to send large volumes of internal email without affecting user mailboxes or overall service health" (Microsoft Learn).

Instead of a user or shared mailbox, each app signs in as an HVE account: a mail-enabled user object with no mailbox and no license. Microsoft's listed scenarios include payroll and HR notifications, IT monitoring alerts, line-of-business app messages, scanner and printer mail, and security notifications.

The reason it exists is the normal mailbox sending limit. Microsoft's Exchange Online limits page sets a recipient rate limit of 10,000 recipients per day and a message rate limit of 30 messages per minute for a mailbox on every listed business and enterprise plan. HVE has no recipient rate limit and no message rate limit. Our guide to Microsoft 365 and Google Workspace sending limits covers the mailbox limits in more detail.

How does HVE compare with SMTP AUTH and a relay connector?

HVE is one of three ways Microsoft lists for apps and devices to send through Microsoft 365. The table below summarizes Microsoft's own comparison on the HVE page.

Microsoft also lists smtp-hve.office365.com as an endpoint that "will be deprecated in the future", so configure new devices with smtp.hve.mx.microsoft. For the older methods, see our guide to scan to email with Microsoft 365.

What are the HVE limits and restrictions?

HVE removes the per-mailbox rate limits but adds its own. These are the service limits Microsoft publishes for HVE at the time of writing (October 2026):

Microsoft also lists what isn't supported:

• No external delivery. "HVE accounts cannot be used for external email delivery."
• No mailbox. An HVE account can't receive mail. Set a Reply-To address if people need to reply.
• No group membership. You can't add HVE accounts to distribution lists or mail-enabled security groups.
• Worldwide cloud only. HVE is supported in the Microsoft 365 Worldwide (standard multi-tenant) environment; other clouds are "under evaluation".

To get past 50 recipients per message, Microsoft suggests sending to a single distribution list or dynamic distribution list. Billing still counts each recipient after the list is expanded.

How much does HVE cost, and how is it billed?

HVE is billed per delivered recipient through Microsoft 365 pay-as-you-go (PAYG) billing, charged to an Azure subscription. Microsoft counts "expanded delivered email recipients", so a message to a 200-member list counts as 200. Check the current per-recipient rate on Microsoft's HVE page before you plan volumes.

Two rules matter in practice:

• Each HVE account needs a billing policy. "Without an assigned billing policy, an HVE account cannot send email." One policy can be shared by several accounts.
• Microsoft's troubleshooting article says HVE billing began on June 1, 2026, and that billing policies became required from that date. An account that worked before June 2026 with no policy will now show Not active.

How do you set up an HVE account?

You need Microsoft 365 pay-as-you-go billing set up for the tenant, with a billing policy connected to the High Volume Email service in the Microsoft 365 admin center. Then:

1. Open the Exchange admin center at https://admin.exchange.microsoft.com.
2. Go to Mail flow > High Volume Email.
3. Select Add an HVE account.
4. Enter a Display name, a Primary email address in one of your accepted domains (for example, alerts-hve@example.com), an optional Alias, and a Password if the app will use basic authentication. The password must meet your organization's password rules.
5. Select Next. On the Pay-as-you-go billing policy step, pick a policy. The step is optional here, but the account can't send until a policy is assigned.
6. Select Next, review, and select Create.
7. Check the Account status column. Active means the account has a valid billing policy and can send.

The same steps in Exchange Online PowerShell

Microsoft documents these cmdlets on the HVE page:

# Create the account (you're prompted for the password)
New-MailUser -HVEAccount -Name "Payroll alerts" -PrimarySmtpAddress "payroll-hve@example.com"

# Find the billing policy ID, then assign it
Get-BillingPolicy -ResourceType HVE
Set-HVEAccountBillingPolicy -Identity payroll-hve@example.com -BillingPolicyId "<policy GUID>"

# Send replies to a real mailbox
Set-HVEAccountSettings -Identity payroll-hve@example.com -ReplyTo "payroll@example.com"

# List all HVE accounts
Get-MailUser -HVEAccount

Configure the app or device

Use these settings, from Microsoft's "Required SMTP settings" table:

Microsoft suggests one HVE account per application or environment, so you can tell traffic apart and turn one off without affecting the others.

Should HVE use OAuth or a password?

Use OAuth when the app supports it. Microsoft recommends it, and in some tenants it's the only option:

• If security defaults are enabled in Microsoft Entra ID, basic authentication is disabled and "HVE can authenticate only by using OAuth."
• HVE accounts can authenticate "even when SMTPClientAuthenticationDisabled is set to True in TransportConfig, because HVE uses a dedicated SMTP endpoint." Turning off SMTP AUTH for your mailboxes doesn't break HVE. Our guide to the SMTP AUTH Basic auth retirement covers the mailbox side.
• If you use authentication policies, the one that applies to the HVE account must allow the method you chose.

For OAuth, Microsoft's OAuth for HVE article has you register an app in Microsoft Entra, add the Office 365 Exchange Online Mail.Send permission (application or delegated), grant admin consent, and request a token for https://outlook.office.com/.default. The app then signs in with SASL XOAUTH2.

By default, any app with valid credentials and the right permission can authenticate to an HVE account. To lock an account to specific apps, add their service principal IDs (from Enterprise applications, not App registrations) with Add-HVEAppAccess. Microsoft allows up to 10 allowed apps per account. This also limits unexpected billing if a secret leaks.

Why can't my app send through HVE?

Start from the exact reply your app or device logs. These codes come from Microsoft's HVE troubleshooting article:

If sign-in works but nothing sends, check billing. Run Get-HVEAccountBillingPolicy -Identity <account> and read BillingPolicyStatus. Microsoft lists values such as NoProperBillingPolicyStored (no policy), BillingPolicyNotFound (policy deleted), NoConnectedBillingPolicyFound (policy not connected to HVE) and SubscriptionIsNotActive.

If an external recipient never gets the message, that's by design: HVE only delivers inside your tenant. Look up any other bounce code in our SMTP Error Code Lookup.

When should you use something other than HVE?

HVE fits internal, automated mail. Pick another route when:

• The mail goes outside your organization. Use OAuth on SMTP AUTH or a relay connector. Azure Communication Services Email also reaches external recipients over SMTP, but it needs an Azure subscription and its own provisioned email domain.
• It's marketing or bulk mail to customers. Use a dedicated sending platform on a subdomain. See separating transactional and marketing mail.
• A device can't do TLS on port 587. HVE requires TLS. A relay connector on port 25 from a static IP may be the only option for old hardware.

For devices that need to reach outside addresses and can't do OAuth, a smart host is another option. iBlockSpam's outbound relay includes 500 messages per domain per month with DKIM signing, which suits scanners and contact forms rather than bulk mail.

Next steps

1. List every app and device that sends as a user mailbox today, and mark which ones only mail staff.
2. Set up pay-as-you-go billing and a billing policy, then create one HVE account per internal-only app.
3. Prefer OAuth, and restrict each account to its app with Add-HVEAppAccess.
4. Set a Reply-To address on any account whose messages people might answer.
5. Check the HVE usage report under Reports > Mail flow > High Volume Email after the first week.

Browse more setup guides, or see how iBlockSpam works with Microsoft 365.