PowerShell Send-MailMessage with Microsoft 365: email through Microsoft 365 after Basic auth ends

Short answer: Send-MailMessage is obsolete (Microsoft Learn) and logs in to smtp.office365.com with a password, which fails once Basic auth is off. Replace it with Send-MgUserMail from the Microsoft Graph PowerShell SDK, using only the Mail.Send permission, or send through a relay connector.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

Send-MailMessage has no OAuth option: its only login is -Credential, a username and password, so it stops working with Microsoft 365 when the Basic auth switch-off reaches your tenant. Microsoft Learn calls the cmdlet obsolete, says it doesn't guarantee secure connections, and points Exchange Online users to Send-MgUserMail from the Microsoft Graph PowerShell SDK (its DE0005 note suggests MailKit for other servers). Send-MgUserMail needs only Mail.Send: delegated for a script run by a signed-in user, application for unattended jobs. The application permission lets the app send as any user, so limit it to one mailbox with Exchange RBAC for Applications, which replaces Application Access Policies.

What you will see when it breaks

Best fix

  1. Install the SDK (Microsoft Learn): Install-Module Microsoft.Graph -Scope CurrentUser -Repository PSGallery -Force. To keep it small, install just Microsoft.Graph.Authentication and Microsoft.Graph.Users.Actions.
  2. Script run by a person: connect with only the send permission, Connect-MgGraph -Scopes "Mail.Send" (Microsoft Learn's interactive pattern, with Mail.Send as the scope).
  3. Unattended script: register an app in Microsoft Entra with a certificate, then connect (Microsoft Learn): Connect-MgGraph -ClientId "YOUR_APP_ID" -TenantId "YOUR_TENANT_ID" -CertificateThumbprint "YOUR_CERT_THUMBPRINT".
  4. Give the app the send right for one mailbox only. In Exchange Online PowerShell run New-ServicePrincipal, then New-ManagementRoleAssignment -App <ObjectID> -Role "Application Mail.Send" -CustomResourceScope <scope> (syntax from Microsoft Learn). Granting Mail.Send in Entra instead covers every mailbox in the tenant, and Microsoft says to remove that grant if you use the scoped role.
  5. Send (Microsoft Learn example 1, shortened): Import-Module Microsoft.Graph.Users.Actions, then $params = @{ message = @{ subject = "Meet for lunch?"; body = @{ contentType = "Text"; content = "The new cafeteria is open." }; toRecipients = @(@{ emailAddress = @{ address = "frannis@contoso.com" } }) } } and Send-MgUserMail -UserId $userId -BodyParameter $params.
  6. Graph answers 202 Accepted: the message was accepted, not yet delivered. It is saved to Sent Items unless you set saveToSentItems to false.

If it can't do OAuth

  1. No Graph possible? Send through an SMTP relay connector from a server with a static public IP (Exchange admin center → Mail flow → Connectors, from Your organization's email server to Office 365). Relay needs no username or password.
  2. Point the script at your MX host on port 25 with TLS. Our example, not from Microsoft: Send-MailMessage -SmtpServer contoso-com.mail.protection.outlook.com -Port 25 -UseSsl without -Credential. Treat it as a bridge only, since Microsoft recommends not using Send-MailMessage.
  3. Add the server's IP to SPF with the SPF generator. Relay doesn't work from Azure or other third-party clouds; use Graph there.
  4. Stopgap only: Set-CASMailbox -Identity script@yourdomain.com -SmtpClientAuthenticationDisabled $false keeps the old -Credential login working until Microsoft removes Basic auth for good. See 535 5.7.139.
Replacement cmdletSend-MgUserMail (module Microsoft.Graph.Users.Actions)
InstallInstall-Module Microsoft.Graph -Scope CurrentUser -Repository PSGallery -Force
Permission (least privileged)Mail.Send: delegated for a signed-in user, application for unattended scripts
Graph endpointPOST /users/{id | userPrincipalName}/sendMail
Success response202 Accepted (accepted, not yet delivered)
Limit app-only sendingExchange RBAC for Applications role "Application Mail.Send" with a management scope
Relay fallbackMX host, port 25, TLS, connector trusts a static IP or certificate, no credentials

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)

Sources

Other devices and apps