SMTP AUTH Basic authentication deprecation, explained

Microsoft's timeline

Microsoft set out the current plan on January 27, 2026, in a post on its Exchange Team blog and in Message Center notice MC786329. The four steps, in Microsoft's words:

1. Now to December 2026
   No change yet
   “SMTP AUTH Basic Authentication behavior remains unchanged.”
2. End of December 2026
   Off by default in existing tenants
   “SMTP AUTH Basic Authentication will be disabled by default for existing tenants. Administrators will still be able to enable it if needed.”
3. After December 2026
   New tenants start without it
   “New tenants created after December 2026: SMTP AUTH Basic Authentication will be unavailable by default. OAuth will be the supported authentication method.”
4. Second half of 2027
   The final removal date is announced
   “Microsoft will announce the final removal date for SMTP AUTH Basic Authentication.”

Microsoft's reason for the extra time: “We understand that many customers continue to face real challenges modernizing legacy email workflows and need sufficient time to adopt viable, secure alternatives.”

For a device that can only sign in with a password, “disabled by default” means it stops sending at the end of December 2026 unless an admin turns Basic authentication back on. Already seeing an error? 535 5.7.139, 535 5.7.3 and 5.7.57 each have their own page, and the rest are on Microsoft 365 SMTP errors.

Sources: Microsoft's Exchange Team blog, Updated Exchange Online SMTP AUTH Basic Authentication Deprecation Timeline; Microsoft 365 Message Center notice MC786329 (updated January 27, 2026) (read October 30, 2026)

Why you've seen other dates

Microsoft has moved this date twice, and articles written before January 27, 2026 still give the old ones.

The 2024 post also gave the response a device would get once Basic authentication was removed for good: 550 5.7.30 Basic authentication is not supported for Client Submission. The January 2026 post doesn't say what a device will show at the end of December.

Sources: Microsoft's Exchange Team blog, Exchange Online to retire Basic auth for Client Submission (SMTP AUTH); Microsoft's Exchange Team blog, Updated Exchange Online SMTP AUTH Basic Authentication Deprecation Timeline (read October 30, 2026)

Who is affected

Anything that sends through smtp.office365.com by signing in with a mailbox's username and password. Microsoft calls this client SMTP submission, or SMTP AUTH, and the password sign-in is Basic authentication. Microsoft's own troubleshooting article for it is written for printers, scanners and line-of-business apps.

• Affected: server smtp.office365.com, port 587 or 25, with a username and password.
• Not affected: the same server signed in with OAuth (often labelled modern authentication or Microsoft 365 sign-in), and devices that send to your MX endpoint on port 25 through Direct Send or an SMTP relay connector.

In some tenants it's already off: Microsoft says SMTP AUTH is already disabled wherever security defaults are on. To read a device's own settings, see check whether your device is affected.

Sources: Microsoft Learn, How to set up a multifunction device or application to send email using Microsoft 365 or Office 365; Microsoft Learn, Enable or disable authenticated client SMTP submission (SMTP AUTH) in Exchange Online (read October 30, 2026)

Find what still signs in with a password

Microsoft's SMTP AUTH clients report lists every sender address that uses SMTP AUTH, and how each one signs in.

1. In the new Exchange admin center, go to Reports > Mail Flow and open the SMTP AUTH clients report.
2. Under Messages sent using SMTP Auth, read the Authentication Protocol column: “Basic Auth is TlsAuthLogin and Modern Auth is XOAUTH2.”
3. Every sender showing Basic Auth (TlsAuthLogin) signs in with a password, so it's affected.
4. “By default, the report shows data for the last 7 days.” Widen the range, up to 90 days, to catch devices that send only now and then.

The report lists sender addresses, not devices: to match one to a copier or app, look for that address in the devices' email settings. It also shows how much of each sender's mail used TLS 1.0, 1.1 or 1.2, and Microsoft has started rejecting a percentage of TLS 1.0 and 1.1 connections to smtp.office365.com (what to do).

Sources: Microsoft Learn, SMTP AUTH clients report in the new EAC in Exchange Online; Microsoft Learn, Fix issues with printers, scanners, and LOB apps that send email using Microsoft 365 (read October 30, 2026)

“Admins can turn it back on”: what it means in practice

Microsoft's words: “Administrators will still be able to enable it if needed.” For an office, that means:

• Someone has to do it. Until an admin does, every device that signs in with a password fails to send. Microsoft's January 2026 post doesn't say which setting it will be. Today SMTP AUTH is switched on per mailbox (the Authenticated SMTP box) or for the whole organization: the steps.
• It's a stopgap. It lasts until the final removal date, which Microsoft will announce in the second half of 2027. Microsoft's earlier plan had no way back once removal came: “Don’t waste your time engaging Support, as they cannot re-enable Basic auth for you.”
• It doesn't get past your security settings. It won't work where:
  • Security defaults are on: “If security defaults is enabled in your organization, SMTP AUTH is already disabled in Exchange Online. To use SMTP AUTH, you need to disable security defaults.”
  • A Conditional Access policy blocks legacy authentication. Microsoft's own “Block legacy authentication” policy covers “clients that use protocols like IMAP, SMTP, or POP3”, and Microsoft adds it to eligible tenants itself: it starts in report-only mode, and Microsoft turns it on no less than 30 days later if it's left there. Microsoft's documented way around such a policy is to exclude the device's mailbox from it.
  • An authentication policy blocks it: “If your authentication policy disables basic authentication for SMTP, clients cannot use the SMTP AUTH protocol even if you enable the settings outlined in this article.”
• New tenants start without it. “New tenants created after December 2026: SMTP AUTH Basic Authentication will be unavailable by default.” Moving to a new tenant after December 2026, for a merger or a migration, means starting without it.
• It keeps a password-only mailbox. Password sign-in over SMTP doesn't support multifactor authentication: Microsoft's own fix for a failing one includes turning multifactor authentication off for that mailbox. Microsoft's reason for retiring it, from 2024: “Basic auth is a legacy authentication method that sends usernames and passwords in plain text over the network. This makes it vulnerable to credential theft, phishing, and brute force attacks.”

Sources: Microsoft's Exchange Team blog, Updated Exchange Online SMTP AUTH Basic Authentication Deprecation Timeline; Microsoft's Exchange Team blog, Exchange Online to retire Basic auth for Client Submission (SMTP AUTH); Microsoft Learn, Enable or disable authenticated client SMTP submission (SMTP AUTH) in Exchange Online; Microsoft Learn, Microsoft-managed Conditional Access policies; Microsoft Learn, Block legacy authentication with Conditional Access; Microsoft Learn, Fix issues with printers, scanners, and LOB apps that send email using Microsoft 365 (read October 30, 2026)

Your routes, side by side

Each route's steps are in the guide; this table is for picking one.

Sources: Microsoft Learn, How to set up a multifunction device or application to send email using Microsoft 365 or Office 365; Microsoft's Exchange Team blog, Exchange Online to retire Basic auth for Client Submission (SMTP AUTH) (read October 30, 2026)

Azure Communication Services Email

Microsoft's 2024 post names it for mail inside and outside your organization. It's an Azure service with its own SMTP server, smtp.azurecomm.net, on port 587 (recommended) or port 25. “Username and password authentication is supported using an SMTP username linked to Microsoft Entra application details.” “The password is one of the Microsoft Entra application's client secrets.” Mail goes out from a domain you verify in Azure: “The From value is the mail from address of your verified domain.” Setting it up takes an Azure subscription, an Email Communication resource with a domain, and a Microsoft Entra application with a client secret.

Sources: Microsoft Learn, Set up SMTP authentication for sending emails (Azure Communication Services); Microsoft's Exchange Team blog, Exchange Online to retire Basic auth for Client Submission (SMTP AUTH) (read October 30, 2026)

The easy path for password-only devices

Microsoft's notice names a third-party solution as one way forward for anything that must keep a username and password: “if you must use Basic auth to send email with Exchange Online, then you must use one of the alternatives or a 3P solution.” CopierBridge is one. Each copier, scanner or app gets its own username and password on port 587 or 465, and the relay sends every message from your own Microsoft 365 mailbox, signed in with Microsoft's OAuth and permission to send only. The device itself never has to support OAuth.

The one Microsoft 365 setting it needs is Authenticated SMTP on that mailbox (steps). It costs $9 a device a month, and your first device is free for 14 days.

Common questions