Runbook Lab · Security · Updated October 2026

SMTP AUTH Basic auth ends in December 2026: the Exchange Online checklist

At the end of December 2026 Exchange Online disables Basic authentication for SMTP AUTH by default in existing tenants. Every printer, scanner and app that sends mail with a username and password stops sending. Six steps to find them and fix them first, starting with read-only checks.

Get the free tracker + checks View on GitHub

Timeline

WhenWhat changes
Now to December 2026No change. Basic auth for SMTP AUTH works as before.
End of December 2026Existing tenants: off by default, admins can turn it back on. New tenants: not available, OAuth only.
Second half of 2027Microsoft announces the final removal date.

Source: Microsoft Exchange Team, "Updated Exchange Online SMTP AUTH Basic Authentication Deprecation Timeline" (January 2026), message center MC786329.

The six steps

1. Check the tenant-wide setting

Read-only. True means SMTP AUTH is already off for the whole organisation.

Get-TransportConfig |
  Select-Object SmtpClientAuthenticationDisabled

2. Find mailboxes that override it

Read-only. False on a mailbox switches SMTP AUTH on for that mailbox even when the tenant has it off. Blank means it follows the tenant.

Get-CASMailbox -ResultSize Unlimited |
  Where-Object { $_.SmtpClientAuthenticationDisabled -eq $false } |
  Select-Object PrimarySmtpAddress, SmtpClientAuthenticationDisabled

3. List every sender still on Basic auth

Exchange admin center > Reports > Mail flow > SMTP AUTH clients report. Request the detailed report: TlsAuthLogin = Basic auth, XOAUTH2 = modern auth. Put each Basic-auth sender in a tracker row with an owner.

4. Pick a fix per sender

App supports OAuth → switch it to OAuth (XOAUTH2). Printer or scanner → firmware with OAuth, or an SMTP relay connector (port 25, your public IP or a certificate). Internal bulk or alert mail → consider High Volume Email or a relay connector. Old PowerShell script → Microsoft Graph sendMail with an app registration.

5. Test before the switch

Turn SMTP AUTH off for one pilot mailbox, send a test from each fixed device, and keep the result in the tracker. Only then plan the tenant-wide change.

6. Close the per-mailbox exceptions

When the report shows no more Basic-auth rows for a mailbox, remove its override from step 2. Re-run the report weekly until the end of December.

Track it like a project

This is control M01 in the free Microsoft 365 Emergency Top 10: a Jira import (epics and stories with owners and a "done" test), a tracker CSV and a read-only PowerShell script that writes a results CSV. Nine more controls that matter before year end are in the same zip: MFA, legacy auth block, break-glass accounts, external forwarding and more.

Download the free Top 10 See all 10 controls

Need the whole tenant? The M365 Hardening Kit: Complete has 58 controls in 5 sprints and 48 read-only checks · €39.

FAQ

When is SMTP AUTH Basic auth switched off in Exchange Online?

Per Microsoft's January 2026 timeline update (message MC786329), Basic authentication for SMTP AUTH client submission is disabled by default for existing tenants at the end of December 2026. Admins can still turn it back on for now; Microsoft says it will announce the final removal date in the second half of 2027.

What breaks when Basic auth for SMTP AUTH is turned off?

Anything that signs in to smtp.office365.com on port 587 with a username and password: multifunction printers and scanners that scan to email, line-of-business apps, ERP and accounting systems, website contact forms, monitoring and backup alerts, and old scripts using Send-MailMessage.

How do I find which devices and apps still use Basic auth for SMTP?

In the Exchange admin center open Reports > Mail flow > SMTP AUTH clients report and look at the Authentication protocol column. Request the detailed report for sender addresses: rows with authMethod TlsAuthLogin are Basic auth, XOAUTH2 is modern auth.

Does this checklist change my tenant?

No. Steps 1 to 3 only read settings and reports. The changes in steps 4 to 6 are yours to make, one sender at a time, after you have a fix for each one.