What does the SMTP AUTH Basic auth retirement mean for your Microsoft 365 tenant?

For years, printers, scanners, scripts and business apps have sent email through Microsoft 365 by signing in to smtp.office365.com with a username and password. Microsoft is retiring that password sign-in, called Basic authentication, for SMTP AUTH. The date has moved several times, so this guide sets out exactly what Microsoft's latest official post says at the time of writing (October 2026), who is affected and what to move to.

What is Microsoft changing?

SMTP AUTH, also called client submission, is how a device or app submits mail to Exchange Online, usually on port 587. Microsoft says it "supports modern authentication (Modern Auth) through OAuth in addition to basic authentication" (Microsoft Learn).

Basic auth sends a username and password with each sign-in. Microsoft removed it from every other Exchange Online protocol in 2022 and early 2023. Its Learn page now says "Basic authentication is now disabled in all tenants", with SMTP AUTH as the exception still being phased out (Microsoft Learn).

The retirement removes Basic auth from SMTP AUTH only. OAuth on SMTP AUTH keeps working.

What is the current timeline?

The latest official source is the Exchange Team's post of January 27, 2026, Updated Exchange Online SMTP AUTH Basic Authentication Deprecation Timeline. Microsoft's Learn page points to it for "current milestones and guidance". It says:

The post applies to all cloud environments. It doesn't say which setting admins will use to turn Basic auth back on after December 2026.

How has the date changed?

Microsoft first announced the retirement in April 2024, with a September 2025 date (Microsoft Tech Community). It later moved the plan to a gradual rejection starting March 1, 2026, with all Basic auth submissions rejected by April 30, 2026. The January 2026 update replaced that with the timeline above. That original post also said there would be no exceptions and support couldn't re-enable Basic auth. The December 2026 step is softer, since admins can turn it back on, but the final removal will follow.

Don't plan around the possibility of another delay. Treat the end of December 2026 as the date things start breaking.

Who is affected?

Anything that signs in to smtp.office365.com (or smtp-legacy.office365.com) with a username and password:

• Multifunction printers and scanners using scan to email.
• Line-of-business apps such as ERP, accounting, CRM and ticketing systems that send invoices or alerts.
• Scripts and scheduled tasks, for example PowerShell's Send-MailMessage with a stored credential.
• Monitoring and alarm systems, UPS units, NAS boxes and building systems.
• Website plugins that send form notifications through a Microsoft 365 mailbox.
• POP and IMAP mail clients that send with SMTP AUTH and a password.

Not affected:

• Outlook, Outlook on the web and Outlook mobile, which don't use SMTP AUTH.
• Devices sending through an SMTP relay connector (authenticated by IP or certificate) or Direct Send.
• Apps already using OAuth with SMTP AUTH.

If security defaults are on in Microsoft Entra ID, Microsoft says SMTP AUTH is already disabled. Tenants with security defaults on shouldn't have password-based SMTP AUTH senders, unless something is already failing.

How do you find devices and apps that use Basic auth?

1. Run the SMTP AUTH clients report. In the Exchange admin center, go to Reports > Mail flow > SMTP AUTH clients. Its Authentication Protocol column shows "Basic Auth" (TlsAuthLogin) or "Modern Auth" (XOAUTH2) for each sender (Microsoft Learn). The default is 7 days. Set the range to 90 days to catch monthly and quarterly jobs.
2. Export it. Use Export to get a .csv and turn it into an inventory: sender address, what the device or app is, who owns it and where it lives.
3. List mailboxes with SMTP AUTH turned on. In Exchange Online PowerShell:

Get-CASMailbox -ResultSize Unlimited |
  Where-Object { $_.SmtpClientAuthenticationDisabled -eq $false } |
  Select-Object PrimarySmtpAddress

False means enabled on that mailbox. A blank value means the mailbox follows the organization setting, so check that too with Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled.

4. Check Entra sign-in logs. Filter the sign-in logs by Client app for Authenticated SMTP to see which accounts sign in with it and from which IP addresses (Microsoft Learn).
5. Ask around. Finance, operations and facilities teams often own systems that IT didn't set up.

What are your options?

Pick one per sender. Microsoft's own alternatives are OAuth, High Volume Email (HVE) and Azure Communication Services (ACS) Email, plus relaying through an on-premises Exchange server in a hybrid setup.

OAuth on SMTP AUTH

If the device or app supports it, this is the smallest change: same server, same port, new sign-in. Microsoft supports delegated flows with the https://outlook.office.com/SMTP.Send scope, and the client credentials flow with the SMTP.SendAsApp application permission. For client credentials, an admin must register the app's service principal in Exchange with New-ServicePrincipal and grant it access to the sending mailbox (Microsoft Learn). Check the vendor's documentation and the latest firmware for OAuth or "Microsoft 365 modern authentication" support.

High Volume Email

HVE uses dedicated accounts that need no license and sign in to smtp.hve.mx.microsoft on port 587. HVE accounts can authenticate even when SMTP AUTH is disabled for the organization. The catch: "HVE accounts cannot be used for external email delivery." Microsoft lists limits of 50 recipients per message, 10 MB per message and 100 HVE accounts per tenant, and bills $0.000042 per delivered recipient through pay-as-you-go billing (Microsoft Learn). Microsoft also notes that with security defaults on, HVE can authenticate only with OAuth.

Azure Communication Services Email

ACS Email sends to internal and external recipients and offers an SMTP endpoint. Its SMTP sign-in uses an SMTP username linked to a Microsoft Entra application, with the app's client secret as the password (Microsoft Learn). It needs an Azure subscription, a verified sending domain and its own SPF and DKIM records.

Relay connector, Direct Send or a third-party relay

A relay connector authenticates by your static public IP or a certificate, so devices on a fixed office connection can keep sending with no password at all. Direct Send reaches internal recipients only and can be abused for spoofing. Our guide to scan to email with Microsoft 365 walks through both setups, and blocking Direct Send covers locking it down.

A third-party relay, or smart host, is another route for devices that can't do OAuth and don't sit on a static IP. Check how the relay authenticates, its monthly limits, and that it signs with DKIM for your domain. iBlockSpam's outbound relay includes 500 messages per domain per month on both plans, with DKIM signing and outbound filtering. It's sized for scanners, small apps and contact forms, not bulk mail.

How do you migrate without breaking mail?

1. Inventory every Basic auth sender from the report and sign-in logs.
2. Choose an option for each from the table above, and record the owner.
3. Update DNS for any new sending path. HVE and relay connectors send as your domain through Microsoft. ACS and third-party relays need your SPF record and DKIM updated, or receivers may reject the mail.
4. Switch one sender at a time and send tests to an internal and an external address. Check the received headers in the Email Header Analyzer for SPF, DKIM and DMARC passes.
5. Turn SMTP AUTH off on each mailbox once its device has moved: Set-CASMailbox -Identity scanner@yourdomain.com -SmtpClientAuthenticationDisabled $true.
6. Rerun the report weekly until no Basic Auth rows are left.
7. Keep SMTP AUTH disabled for the organization and enable it only where OAuth senders need it, as Microsoft recommends.

What errors will you see?

Paste any other bounce into the SMTP Error Code Lookup.

Next steps

• Run the SMTP AUTH clients report for 90 days today and export it.
• Contact vendors of any printer or app in the list and ask about OAuth support for Microsoft 365.
• Move internal-only senders to HVE, external senders to OAuth, ACS, a relay connector or a smart host.
• Aim to finish well before the end of December 2026, and check the Exchange Team blog post again for changes before you rely on the date.
• If you're also tidying up how mail reaches you, see our Microsoft 365 platform page.

Browse more setup guides.