IMPORTANT: Schools using Bromcom SMTP are not affected by this update and DO NOT need to take any action. Similarly, schools who are using their Own SMTP but are NOT using Google or Office 365 as their email service provider also DO NOT need to take action.
In the coming weeks we will be making updates to how Email Integration works in Bromcom to help support more secure email sending.
We currently support Basic Authentication but will be updating to OAuth 2.0 and this will become the Mandatory method of authentication.
These changes affect all schools who are using the integrated Office 365 and Google SMTP options and they will need to take action to ensure their Email Integration continues to work smoothly.
The planned release date for this change is currently 7th August 2025.
The email providers will no longer be supporting Basic Authentication from March 2026 however, to avoid any disruption to your email services, we would advise that you take the below action as soon as possible.
What Do I Need To Do?
Once the update has been made your System Administrator or IT team will need to update your email settings.
To do this go to Config > Setup > System Settings, where you’ll see 2 options:
- Office 365 SMTP See Important – Office 365 SMTP
- Google SMTP. See Important – Google SMTP
Click on the relevant option for your school and you’ll then see a Grant Access button.
Upon clicking Grant Access you’ll be asked to Sign In. Enter the Sign-In details for the account you are currently using. If you are unsure what to enter your IT team should be able to guide you.
Once you’ve logged in, the From E-Mail address field will be populated.
You can then test that the connection has been made successfully by entering an email address that you have access to in the Test E-Mail Address field and clicking Test SMTP, you will receive a successful message in the top right hand corner, please note that this should not be taken as confirmation that the connection has been made successfully. You should then receive an email to the inbox of the Test E-Mail you entered, once you receive the email, this confirms that the connection has been made successfully.
IMPORTANT – GOOGLE SMTP When signing in to your Google Account, make sure you tick the checkbox “Select what bromcom can access – Send email on your behalf” before clicking Continue.
If you do not tick this checkbox, access will not be granted access and the Test E-Mail Address stage will fail.
The following Message will appear in Config > Setup > System Logs > Error Logs.
To correct this:
- In your Google Account, go to Manage your Google Account > Third-Party Connections > Bromcom. Click “Delete all connections that you have with bromcom” and Confirm.
- In the MIS, go to Config > Setup > System Settings and click Revoke Access.
Finally, restart the process and ensure the checkbox is selected this time before clicking Continue.
IMPORTANT – OFFICE 365 SMTP When signing in to your Office 365 Account, you will complete a full Microsoft 365 authorisation.
- System configuration has been updated so that this authorisation is required only once.
- Any future prompts (for updates or revalidation) will require login only, rather than full re-authorisation.
Automatic Token Refresh
- Tokens will now automatically refresh after each successful email send.
- Each successful message resets the 90-day validity period.
- This reduces the likelihood of unexpected expiry and interruption to email services.
- No action is required unless you are prompted to log in.
Resolution of 90-Day Token Expiry Loops
- When the 90-day token expires, users will no longer be caught in an authentication loop.
- If the account has already been authorised, users will simply be prompted to log in again.
- Repeated consent screens should no longer occur.