Microsoft 365 Turns Off SMTP AUTH Basic Authentication in December 2026: What Stops Sending Mail and What to Do

At the end of December 2026 Exchange Online disables SMTP AUTH Basic authentication by default for every existing Microsoft 365 tenant. Anything that sends mail through a Microsoft 365 mailbox with a plain login and password will start getting refused: the contact form on the website, the CRM, the office scanner, the script that sends invoices at night. Here is what exactly changes, how to find every such sender in an afternoon, the ways out with their limits, and why we send our own systems' mail through Google Workspace and our own code.

The timeline

What changes and when

Microsoft announced the current schedule on the Exchange Team blog on 27 January 2026. It has four steps:

The date has already moved twice. In April 2024 Microsoft planned to retire it in September 2025, then moved the start to 1 March 2026 with full rejection by 30 April 2026, and in January 2026 replaced that with the schedule above. Every time, the direction stayed the same. SMTP AUTH is the last place in Exchange Online where a plain password still works: Basic authentication for the other protocols, such as POP, IMAP and Exchange Web Services, was switched off back in October 2022.

The useful reading for an owner is simple. The December step can be undone by your administrator with one setting, so nothing is lost for good on 1 January. The step after it, announced for the second half of 2027, is the one that will not be undone, and everything that depends on a password today will have to move anyway.

Who is affected

What sends mail this way

The change does not touch people. Employees who open Outlook on a laptop or a phone sign in with modern authentication and will not notice anything. It touches machines and programs that were set up once with the address smtp.office365.com, port 587, a mailbox and its password, and then forgotten.

In the companies we have worked with, these senders usually turn up in five places:

• the website: contact and order forms, password reset emails, order confirmations, often through an SMTP plugin in WordPress or an SMTP setting in a Laravel or Symfony application;
• business systems: a CRM, an ERP or an accounting program that sends notifications, quotes and invoices from a shared address such as info@ or noreply@;
• office devices: multifunction printers and scanners with scan to email, where the password was typed into the device menu by someone who left years ago;
• monitoring and backups: servers, alarm systems and backup jobs that report failures by email;
• old scripts: a nightly export, a report for the director, a reminder to customers, written by a contractor and running on a server nobody looks at.

The common feature is a password stored somewhere outside a person's head: in a configuration file, a plugin setting, a device menu. That is exactly what Microsoft wants to remove, and for good reason. A shared mailbox password that sits in five places and is known to three former contractors is one of the easiest ways into a company's mail.

What breaks

How the failure looks

After the switch, a program that tries to sign in with a password gets an authentication error from the server instead of a send. Microsoft's own announcement quotes the answer clients will see after the final removal: 550 5.7.30, Basic authentication is not supported for Client Submission. What happens next depends on how the program was written.

A scanner shows an error on its screen, and someone walks to IT the same morning. A monitoring job fails without a sound, and nobody knows until the failure it was supposed to report. The website is the worst case: many forms show "Thank you, we will contact you" whether the email left or not, so the visitor leaves happy and the request is lost.

A form that says thank you and loses the request is worse than broken.

That is one of the first things we check on a site we take over. On our own site, every request from every form is written to a log on the server before the email is sent, and the email is only a notification on top of it. If the mailbox refuses, the request is still in the log and in the admin panel. If your site only sends an email and keeps nothing, the December change is a good moment to fix that too. More on why leads go missing in Why Your Business Isn't Getting Leads From Its Website.

How to find them

Every sender in an afternoon

Microsoft gives administrators a ready report, and it is the best place to start. In the new Exchange admin center go to Reports, then Mail flow, then the SMTP AUTH clients report. It lists every address that sent mail through SMTP AUTH, the domain, how many messages, which TLS version, and the authentication protocol. TlsAuthLogin in that column means Basic authentication, a login and password; XOAUTH2 means modern authentication, already fine. The report covers up to 90 days and exports to CSV.

The report gives you mailboxes, not devices. The next step is to match each address with what is behind it:

• search the website and application settings for smtp.office365.com: the .env file of a Laravel application, the mailer settings of a Symfony one, the SMTP plugin in WordPress;
• open the settings of the CRM, accounting and helpdesk systems and look for an outgoing mail server;
• walk around the office: printers and scanners keep their mail settings in the device menu or its web page;
• ask whoever runs your servers which jobs send email, and from which address.

Then test before December instead of waiting for it. SMTP AUTH can be turned off for one mailbox while the rest of the company keeps working. Pick the mailbox the website uses, turn it off on a weekday morning, send a test from every form and device that should use it, and see what fails. The commands come from Microsoft's documentation on SMTP AUTH:

# turn SMTP AUTH off for one mailbox (test)
Set-CASMailbox -Identity noreply@example.com -SmtpClientAuthenticationDisabled $true

# back to the organization setting
Set-CASMailbox -Identity noreply@example.com -SmtpClientAuthenticationDisabled $null

# the organization-wide switch ($false means enabled)
Set-TransportConfig -SmtpClientAuthenticationDisabled $false

A test like this takes an hour and gives a list that no inventory spreadsheet will. If the list is long or nobody knows who set up half of it, that is a familiar situation after a change of contractor, and it is covered in Taking Over a Website or App From Another Developer.

The ways out

Four options and their limits

Turning Basic authentication back on after December is allowed, and for a scanner in a branch office it may be the honest short-term answer. It is not a plan. The real choice is between four routes, and they fit different senders.

Two routes are better avoided. Direct Send, which lets a device drop mail into your tenant without signing in, only delivers inside the company, and Microsoft writes in its documentation that it is working on disabling it by default. Azure Communication Services Email still appears in some guides as the option for external mail, but in September 2026 Microsoft announced that Azure Communication Services is being retired as a standalone offering by 30 September 2028, with Email in the list. Building something new on it now means moving twice.

OAuth for a site

What it takes in code

For a website or an application, OAuth is the cleanest route if you want to keep sending from your Microsoft 365 domain. It is also more work than changing a password, and the work is on both sides: in Microsoft's admin portals and in the code.

On the Microsoft side, an administrator registers an application in Microsoft Entra, gives it the Exchange Online application permission SMTP.SendAsApp, grants admin consent, then creates a service principal for that application in Exchange Online with PowerShell and gives it rights to the mailbox it will send from. Microsoft's documentation warns about one detail that trips people up: the service principal needs the Object ID from the Enterprise applications page, not the one shown on the app registration overview.

On the code side, the application no longer stores a password. It stores the application ID and a secret or certificate, asks Microsoft for an access token with the scope https://outlook.office365.com/.default, and uses that token to sign in to smtp.office365.com. Tokens are short-lived, so the code has to request new ones and handle the moment when a request fails. The mail libraries of modern PHP frameworks can sign in with a token, but someone has to write that part, store the secret properly and keep it working when the secret expires.

Old plugins and older devices often cannot do OAuth at all. For them the choice is the relay connector, HVE for internal mail, a firmware update, or moving that sender to another service. A site on a version of WordPress, Laravel or PHP that has not been updated for years may simply not have a mail library that can do it, and then the email question becomes part of a larger one. Three other deadlines for old PHP sites fall in the same weeks, as covered in Symfony 6.4, Drupal 10 and PHP 8.2: Three Support Deadlines Before 2027.

Our choice

Why we send through Google Workspace

We are often asked which mail platform we recommend, so here is what we do ourselves. Our own sites and systems send their mail through Google Workspace, and the systems themselves are ours: we write them for our own work and keep developing them, so the path a message takes, from the form to the log to the email, is code we know line by line.

We have had clients on Microsoft 365, and we have nothing against it as a mailbox for people. As a base for systems that we build and change every week, it has felt heavy and slow to move to us. Sending one notification from a website properly now involves Microsoft Entra, the Exchange admin center, PowerShell, permissions and consent, and the schedule for this one change has been rewritten twice since 2024. For a large company with an IT department that is normal life. For a business that wants its website to send a request to a manager, it is a lot of machinery.

For a website, email is part of the system, not a mailbox setting.

So our advice does not depend on whose logo is on the mailbox. Keep people's mail where your people are comfortable. Take the website's and the systems' mail off a shared human mailbox and its password: give it its own route, its own log and its own alert when something fails. Whether that route is OAuth to Microsoft 365, a relay, or a separate service depends on what sends and to whom. How the website, CRM and accounting should exchange data without breaking is a related topic in How to Connect CRM, Website, Warehouse and Accounting So the Data Stays Right.

The plan

What to do before December

Six weeks are enough for most small and medium companies, if the work starts now and not on 28 December:

• this week: run the SMTP AUTH clients report for the last 90 days and export it;
• next week: match every address with a device, a system or a script, and name an owner for each;
• then: choose the route for each sender, starting with the website and anything that talks to customers;
• before mid-December: switch the senders, test each one with SMTP AUTH turned off for its mailbox, and change the passwords of shared mailboxes that are no longer used for sending;
• after the holidays: keep the report open for another month to catch anything that sends only once a month or once a quarter.

If you decide to turn Basic authentication back on after December for a device that cannot be changed yet, write down which one, why, and the date by which it will be replaced. That list is what you will need when Microsoft announces the final date in 2027. Keeping the site's mail, forms and integrations healthy month after month is what website maintenance and support covers, and moving mail between servers and services is part of our DevOps and cloud work.

We keep this date, with the other deadlines that matter to owners, in the calendar of technology deadlines of The Structure, our brand for software M&A. If a sale or an investor is ahead, what the change means for a deal is in its note Mail sent with a password: the Microsoft 365 change that reaches a deal.

FAQ

Sources

• Updated Exchange Online SMTP AUTH Basic Authentication Deprecation Timeline, Exchange Team blog, January 2026
• How to set up a multifunction device or application to send email using Microsoft 365, Microsoft Learn
• Authenticate an IMAP, POP or SMTP connection using OAuth, Microsoft Learn
• Manage High Volume Email for Microsoft 365, Microsoft Learn
• SMTP AUTH clients report in the Exchange admin center, Microsoft Learn