At the end of December 2026 Microsoft will disable SMTP AUTH Basic Authentication by default in Exchange Online, the method many multifunction printers, ERP applications, monitoring systems and scripts use to send mail with a username and password. SMTP AUTH is not going away: it will keep working with OAuth, and administrators will be able to re-enable Basic Authentication temporarily. But systems nobody checks may stop sending email in January without warning.
Key points on the end of SMTP AUTH Basic in Exchange Online in 30 seconds
- At the end of December 2026, SMTP AUTH Basic Authentication is disabled by default for existing tenants.
- Administrators can re-enable it temporarily; new tenants will not have it.
- Microsoft will announce the final removal date in the second half of 2027.
- The SMTP AUTH Clients report in the Exchange admin center helps find who still uses it.
Basic Authentication, sending a username and password on every connection, has been disappearing from Exchange Online for years. Microsoft removed it in 2022 from protocols such as POP, IMAP, EAS and EWS, but left out mail submission through SMTP AUTH (what Microsoft calls Client Submission, port 587 on smtp.office365.com) because so many hard-to-update devices and applications depend on it. The retirement was announced in April 2024, postponed several times, and the final timeline was published by the Exchange team on 27 January 2026.
Microsoft’s timeline
Until December 2026 nothing changes. At the end of December, SMTP AUTH Basic Authentication becomes disabled by default for all existing tenants, although administrators will still be able to turn it back on if needed. Tenants created after December 2026 will not have it available by default, and OAuth will be the supported method. In the second half of 2027 Microsoft will announce the date on which it is removed completely. From then on, clients trying to send with Basic Authentication will receive the error 550 5.7.30 Basic authentication is not supported for Client Submission.
The option to re-enable it is breathing room, not a solution. It helps if something breaks in January, but the final removal is coming, and that time is better spent migrating than reopening the door and forgetting about it.
What to check before December
The problem is not having SMTP AUTH enabled; it is not knowing which systems still send with a username and password. The first step is an inventory. In the Exchange admin center, the SMTP AUTH Clients report (under Reports, Mail flow) has shown since October 2024 whether each submission uses Basic Authentication or OAuth, and which accounts are involved. From there, identify the devices and applications behind each account: printers and scanners that email documents, ERP and invoicing software, monitoring and alarm systems, backup tools that send reports, and internal scripts.
Pay special attention to anything that has run for years without maintenance, and to systems that only send mail occasionally. A tool that alerts only during an incident, produces a monthly report or runs a one-off process may not show up in recent report data and fail exactly when it is most needed. Working today does not mean ready for the change.
With the inventory done, decide what to do with each system. If it supports OAuth, configuring it is the natural path, although many older printers and applications do not. For those there are alternatives: send through an Exchange Online SMTP relay connector that trusts the organisation’s static public IP, use services such as Microsoft 365 High Volume Email for internal recipients or Azure Communication Services, or rely on an in-house relay server or a third-party provider. Anyone running their own bulk sending also needs SPF, DKIM and DMARC in order, as covered in our guide to staying out of spam in Gmail and Outlook.
Frequently asked questions
Is SMTP AUTH going away in Exchange Online?
No. What is disabled by default is Basic Authentication with a username and password; SMTP AUTH will keep working with OAuth.
When does Basic Authentication stop working?
It is disabled by default at the end of December 2026. Administrators can re-enable it temporarily until final removal, whose date Microsoft will announce in the second half of 2027.
How do I find which systems use it?
With the SMTP AUTH Clients report in the Exchange admin center, which distinguishes between Basic Authentication and OAuth.
What if a printer does not support OAuth?
Use another sending path, such as an Exchange Online SMTP relay connector with a static IP, a Microsoft sending service or your own relay server.
Sources: