Exchange Online switches off basic SMTP AUTH by default this winter

Exchange Online switches off basic SMTP AUTH by default this winter

3 November 2026: Copiers, scanners, monitoring tools and old line-of-business applications that send mail through Microsoft 365 with a username and password have about eight weeks left before that stops working by default. At the end of December 2026, Microsoft will disable SMTP AUTH with basic authentication for every existing Exchange Online tenant; administrators can still turn it back on for now.

Not yet independently verified. Microsoft gives no exact day for the change beyond "end of December 2026", and we found no newer post from Microsoft than the timeline of 27 January (updated 29 January). We will update this when it can be confirmed, and remove this note.

The four steps Microsoft has set

Microsoft's Exchange team laid out the timeline in January, after earlier dates were pushed back on customer feedback:

• Now to December 2026: nothing changes; basic SMTP AUTH works as it does today.
• End of December 2026: basic SMTP AUTH is disabled by default for existing tenants. Administrators will still be able to enable it if needed.
• Tenants created after December 2026: basic SMTP AUTH is unavailable by default, and OAuth is the supported method.
• Second half of 2027: Microsoft announces the final removal date.

The timeline applies to tenants in all of Microsoft's cloud environments, government clouds included. Microsoft's Learn page on the wider basic-authentication retirement points administrators to Microsoft Graph or to OAuth 2.0 for IMAP, POP and SMTP AUTH as the replacements.

What breaks on the first working day of January

The hard cases are not mail clients, which moved to modern authentication years ago, but devices and scripts that cannot be updated. A multifunction printer with scan-to-email set up against smtp.office365.com with a mailbox password, a building-management system that sends alarm emails, an accounting package that emails invoices from a shared mailbox, a PowerShell script that relies on Send-MailMessage: each fails to send once the tenant default flips, unless someone re-enables the setting.

Because the re-enable switch survives until a removal date that has not been set, many administrators will be tempted to flip it back and move on. That buys time, not a fix, and Microsoft has said the final date will be announced during the second half of 2027.

Moving devices before the default changes

Practical routes off password-based SMTP AUTH depend on what the sender can do:

• devices and apps that support OAuth 2.0 for SMTP can be re-registered with an app registration in Microsoft Entra ID;
• applications that can call an API can send through Microsoft Graph instead of SMTP;
• devices that support neither can send through an Exchange Online connector based on the office's IP address or certificate, or through a relay that holds the modern credentials on their behalf, a gap some vendors are now selling into.

The first job is an inventory: the SMTP AUTH clients report in the Exchange admin center shows which accounts still send with basic credentials, and those accounts are the list to work through before the holidays.

Our catalogue lists 10 email management products and 18 transactional email services, the category many line-of-business senders move to when Microsoft 365 is no longer the right relay.

Sources

• Microsoft Exchange Team: Updated Exchange Online SMTP AUTH Basic Authentication Deprecation Timeline, 29 January 2026
• Microsoft Learn: Deprecation of Basic authentication in Exchange Online (read 3 November 2026), 3 November 2026