Microsoft 365 SMTP AUTH: Basic Authentication Off by Default at the End of December 2026

Short answer: At the end of December 2026 Microsoft turns off Basic authentication (username and password) for SMTP AUTH in existing Exchange Online tenants. Printers, scanners, apps and scripts that log in to smtp.office365.com with a password will fail. Move them to OAuth or an SMTP relay now.

WhoMicrosoft
Statusconfirmed
Dates
  • 2026-12: Basic auth for SMTP AUTH disabled by default in existing tenants (end of December); admins can still turn it back on
  • 2027-01: Tenants created after December 2026 get no Basic auth for SMTP AUTH; OAuth is the supported method
  • 2027-H2: Microsoft announces the final removal date

Who is affected

Every Microsoft 365 tenant where a printer, scanner, application, reporting server, script or POP/IMAP mail client sends through smtp.office365.com with a username and password. Outlook, Outlook on the web and Outlook mobile don't use SMTP AUTH, so people's normal mail keeps working.

What you will see

Check your setup today

  1. Run our checker on your domain. If the MX ends in .mail.protection.outlook.com or .mx.microsoft, or SPF contains include:spf.protection.outlook.com, your mail runs on Microsoft 365 and this change applies to you.
  2. In the Exchange admin center, open the SMTP AUTH clients report. Microsoft added a column that shows whether each sender uses Basic auth or OAuth. Every row with Basic auth will break.
  3. Look at each device or app's mail settings: server smtp.office365.com, port 587, plus a username and password means Basic auth.
  4. In Exchange Online PowerShell, run Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled and Get-CASMailbox -Identity user@yourdomain.com | Format-List SmtpClientAuthenticationDisabled to see where SMTP AUTH is switched on today.

How to fix it

  1. Apps and scripts that support OAuth (Microsoft calls it Modern authentication): switch their SMTP login to OAuth. This is the method Microsoft supports long term.
  2. Devices that can't do OAuth: use SMTP relay. Create an inbound connector in the Exchange admin center that trusts the device's TLS certificate or static public IP, point the device at your MX host on port 25, and add that IP to your SPF record (SPF generator). Relay doesn't work from third-party clouds such as Azure.
  3. Mail that only goes to people inside your own organization: Microsoft's High Volume Email (HVE) accepts Basic auth or OAuth, but it can't send to outside recipients.
  4. Stop-gap only: Microsoft says admins can turn Basic auth back on after the default change (Set-TransportConfig -SmtpClientAuthenticationDisabled $false, or per mailbox with Set-CASMailbox -Identity user@yourdomain.com -SmtpClientAuthenticationDisabled $false). It doesn't work while security defaults are on, and it ends when Microsoft sets the final removal date.
  5. Re-test each device with its "send test email" button, then check the SMTP AUTH clients report again until no Basic auth rows are left.

Step-by-step for your device or app

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)

Check your domain now

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 28-page guide, checklist, 20+ providers.

Related pages

Sources

Other upcoming changes