What SMTP AUTH Basic auth retirement breaks and how to fix it

Microsoft is turning off the option to send email through Exchange Online with a plain username and password. SMTP AUTH, also called client SMTP submission, is how many devices and apps send mail through smtp.office365.com on port 587. The replacement Microsoft supports is modern authentication with OAuth, which uses tokens issued by Microsoft Entra ID.

Microsoft published the current schedule on the Exchange Team blog on January 27, 2026:

That update replaced an earlier, faster schedule, so older articles quoting spring 2026 dates are out of date. Re-enabling Basic auth in January buys time, but a final removal date is coming.

Anything that signs in to smtp.office365.com with a mailbox username and password will stop sending mail. In small and midsize businesses, that usually means four groups:

• Scan-to-email on copiers and multifunction printers.This is the most common break. The front desk scans a document and nothing arrives.
• Line-of-business applications.Accounting packages, ERP and inventory systems, practice management software and job scheduling tools that email invoices, statements, reminders or alerts.
• Website forms.Contact, quote request and booking forms, often a WordPress plugin, configured to send through an Office 365 mailbox.
• Alerts from infrastructure.Backup appliances, firewalls, UPS units, NAS boxes and building systems that email warnings.

For example, a 25-person law firm might find its copier, its billing system's statement emails and its website contact form all use the same "scanner@" mailbox with a password set years ago. A distributor might discover that its warehouse system emails pick tickets through a former employee's account.

The fastest way is the SMTP AUTH Clients report in the Exchange admin center, under Reports, then Mail flow. Microsoft documents that it shows SMTP AUTH use by user and system accounts, defaults to the last 7 days, and can be widened to 90 days.

Pair the report with a walk-through of your office:

• List every copier, scanner and appliance that sends email, and check its SMTP settings page.
• Ask each department which software sends email on its behalf.
• Check your website's mail settings or form plugin.
• Note which mailbox each one uses and who knows its password.

If your organization has turned on Microsoft Entra security defaults, Microsoft notes that SMTP AUTH with Basic authentication is not compatible with them, so some of these devices may already be failing quietly.

Fix scanners and copiers by moving them to OAuth if the device supports it, or to an SMTP relay connector if it does not. Some current multifunction printers have firmware that supports Microsoft 365 modern authentication, so check for a firmware update first.

For older devices, Microsoft's options are:

• SMTP relay through a connector.The device sends to your domain's MX endpoint on port 25, and an inbound connector in Exchange Online trusts it by TLS certificate or by a static public IP address that only your organization uses. No mailbox license is needed, and it can send to outside recipients.
• High Volume Email (HVE).Suited to devices that only send to people inside your organization. HVE accounts support OAuth, and Microsoft also lists Basic authentication for them.
• Direct Send.The device sends anonymously to your MX endpoint and can only reach your own mailboxes. Microsoft recommends it only for advanced admins and says it is working on an option to disable Direct Send by default.

For example, a dental practice with two scanners on an office connection with a static IP can usually move both to a relay connector in an afternoon. Microsoft also notes that a device defaulting to port 465 does not support the TLS versions Exchange Online requires, which usually means it needs a firmware update or a relay.

Fix business applications by updating them to send with OAuth or the Microsoft Graph API, or by pointing them at a different sending service. Start by asking the vendor whether the current version supports Microsoft 365 modern authentication. Some vendors have added it in recent releases.

If the vendor has no OAuth option:

• Use a relay connectorwhen the app runs on a server in your office with a static IP.
• Use Azure Communication Services Email, which Microsoft lists for apps that must reach both internal and external recipients.
• Use the app's own email serviceor a transactional email provider, if the vendor offers one.

Remember that Microsoft says a relay connector cannot be used for mail coming from third-party hosted services. A cloud-hosted app needs OAuth, Graph or a separate sending service.

Fix website forms by switching them to OAuth or Microsoft Graph, or by sending through a transactional email service. Website hosting is a third-party service, so a relay connector is not an option. Several WordPress mail plugins can connect to Microsoft 365 with OAuth through an app registration in Entra ID.

For example, a construction company whose quote form sends through an Office 365 mailbox should test a form submission after the change and confirm the email arrives with the correct sender. A form that fails silently loses leads, so set up an alert or a daily test submission.

Inventory everything that sends mail, then fix the easy ones and plan the hard ones. A practical order:

• Run the SMTP AUTH Clients report and list every account that appears.
• Update copier and appliance firmware, and switch what you can to OAuth.
• Set up a relay connector for anything that cannot do OAuth.
• Contact software vendors about OAuth or Graph support.
• Move website forms to OAuth or a sending service.
• Turn off SMTP AUTH on mailboxes that no longer need it.

Clients on our managed IT plans get this inventory and remediation as part of normal support. Our Microsoft 365 and cloud infrastructure work covers connectors, app registrations and mail flow for businesses that need a one-time project.

If you are not sure what in your office still sends mail with a password, book a free 30-minute call through our contact page. We will help you size the job and tell you what can wait.