What changes, and when
| When | What happens |
|---|---|
| Now to December 2026 | Nothing changes. Basic authentication for SMTP AUTH keeps working. |
| End of December 2026 | Turned off by default in existing tenants. Admins can turn it back on for now, which buys time but not a fix. |
| Tenants created after December 2026 | Not available by default. OAuth is the supported way. |
| Second half of 2027 | Microsoft announces the date it is removed for good. |
What usually breaks
- Copiers and scanners that scan to email.
- Line-of-business apps that send invoices, appointment reminders or reports: practice management, accounting, ERP.
- Scripts and scheduled tasks, including PowerShell's
Send-MailMessagewith a password. - Alerts from equipment: UPS units, NAS boxes, backup servers, phone systems, building controls.
- Website contact forms and plugins that send through a Microsoft 365 mailbox.
Outlook on Windows, Mac, the web and phones is not affected; it already uses modern authentication. Neither is anything already sending with OAuth, through direct send or through a connector.
Find every sender
1. Check the SMTP AUTH report (5 minutes)
In the Exchange admin center, open Reports > Mail flow > SMTP AUTH clients. Set the date range to 90 days (it shows 7 by default). Every row is a sender address; the Authentication protocol column says Basic Auth or Modern Auth. Every Basic Auth row stops sending at the end of December.
2. Check the sign-in logs (10 minutes)
In the Microsoft Entra admin center, open Sign-in logs, add the filter Client app and choose Authenticated SMTP. The IP address on each sign-in tells you which office, server or device sent it. Without an Entra ID P1 licence the logs only go back 7 days, so check again next week to catch monthly jobs.
3. List the mailboxes allowed to use it (5 minutes)
In Exchange Online PowerShell, see the organization setting, then the mailboxes switched on one by one. A blank value on a mailbox means it follows the organization setting.
Connect-ExchangeOnline
Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled
Get-CASMailbox -ResultSize Unlimited |
Where-Object { $_.SmtpClientAuthenticationDisabled -eq $false } |
Select-Object PrimarySmtpAddress4. Walk the building (an hour)
Reports miss devices that send once a month. Open the email settings page of every copier, scanner, UPS, NAS, phone system and line-of-business server. Anything set to smtp.office365.com on port 587 with a username and password is on the list.
Move each one
Pick an option per sender. Try them in this order.
| Option | Use it when | Can send to |
|---|---|---|
| OAuth (modern authentication) | The device or app supports it, often after a firmware or version update. Check with the vendor first. | Anyone |
| SMTP relay through a connector | The device sends from an office with a fixed public IP address. It sends on port 25 to your domain's MX host, and a connector in Exchange Online recognises your IP address or certificate. | Anyone |
| Direct send | The device only emails people in your own organization, such as scan to email. It sends on port 25 to your MX host with no sign-in. Check that direct send isn't blocked in your tenant. | Your own mailboxes only |
| A third-party SMTP service | Nothing above fits, for example an old device with no OAuth at a site with no fixed IP. | Anyone |
For scripts, replace Send-MailMessage with the Microsoft Graph sendMail call using an app registration. Microsoft also offers High Volume Email for internal notifications; check its current status before relying on it.
A plan that fits before December 31
- This week: run the four checks above and make one list: device or app, mailbox, location, owner.
- Next three weeks: move each sender, starting with what customers notice (invoices, reminders), then scanners.
- Mid-December: switch SMTP AUTH off on each moved mailbox and watch for a day. Anything that breaks was missed; far better to find it now than on January 2.
- Keep the list. The final removal date comes in 2027, and turning it back on only delays the same work.