Find every printer and app still using Microsoft 365 SMTP AUTH (free script)

One read-only PowerShell script lists every mailbox, printer, scanner and app that sends through Microsoft 365 SMTP AUTH, with a verdict for each, before Microsoft turns Basic authentication off by default at the end of December 2026.

Download Find-SmtpAuthSenders.ps1 Free · read-only · Windows PowerShell 5.1 or PowerShell 7 · version 1.0 (25 Oct 2026) · source, tests and issues on GitHub (MIT)

Or install it from the PowerShell Gallery: Install-Script -Name Find-SmtpAuthSenders -Scope CurrentUser

What it reads

Source	What you learn	Needs
SMTP AUTH settings (always)	Who is allowed to use SMTP AUTH: the tenant setting and every mailbox. An empty mailbox value means the tenant setting applies, and the script resolves that for you.	Exchange Online PowerShell (`ExchangeOnlineManagement`), a role that can read mailboxes
Usage report, 180 days (`-IncludeUsageReport`)	Which accounts actually sent with an "SMTP App". That is twice the 90 days the admin center report covers.	`Microsoft.Graph.Authentication`, Reports.Read.All, a role such as Reports Reader
Sign-in logs (`-IncludeSignInLogs`)	"Authenticated SMTP" sign-ins with the IP address. The IP tells you which office or device it is.	AuditLog.Read.All, Entra ID P1 or P2
Admin center CSV (`-AdminCenterCsv`)	Basic auth (TlsAuthLogin) versus OAuth (XOAUTH2) per sender. Export it from Exchange admin center → Reports → Mail flow → SMTP AUTH clients report.	The exported CSV file

How to run it

Install the modules once: Install-Module ExchangeOnlineManagement -Scope CurrentUser and, for usage and sign-ins, Install-Module Microsoft.Graph.Authentication -Scope CurrentUser.
Get the script: Install-Script -Name Find-SmtpAuthSenders -Scope CurrentUser, or download it above, read it (it only reads), then unblock it: Unblock-File .\Find-SmtpAuthSenders.ps1. If PowerShell refuses to run scripts, allow it for that window only: Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass.
Settings only: .\Find-SmtpAuthSenders.ps1
Everything: .\Find-SmtpAuthSenders.ps1 -IncludeUsageReport -IncludeSignInLogs -AdminCenterCsv .\smtpauth.csv
Open SmtpAuthSenders-<date>.html (a CSV is written next to it).

What the verdicts mean

BREAKS end of Dec 2026: the admin center report shows Basic auth. Move it to a relay connector, Direct Send or OAuth.
CHECK: it sent with SMTP AUTH (usage report or sign-in logs), but the method is unknown. Add the admin center CSV to see Basic vs OAuth.
Allowed but no use seen: SMTP AUTH is on but nothing used it. You can switch it off for that mailbox.
OK: OAuth / OK: SMTP AUTH off: nothing to do.
Not a mailbox in this tenant: a sender in the logs that isn't a mailbox, e.g. a deleted account or another tenant. Check it.

Tested with sample data on 25 Oct 2026; it changes nothing in your tenant. If it fails on your tenant, tell us with the 👎 button below (with the error message) and we'll fix it.

Then fix each device

Step-by-step pages for HP, Canon, Ricoh, Xerox, Brother, WordPress, Synology/QNAP, PowerShell and more, plus dates and background.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)

Rather have it done for you? I move your devices and apps on Fiverr – relay, Direct Send or OAuth, tested, from $25.

Did this fix it?