What is changing?
Exchange Online will turn off Basic Authentication for SMTP AUTH by default for existing tenants at the end of December 2026. New tenants created after that won't have the option at all. Microsoft will announce the final removal date in the second half of 2027.
Microsoft has postponed the change several times, but this time the timeline is clear.
Who is affected?
Typically, it's devices and systems that send email with a username and password: scan-to-email scanners, alerting systems, older line-of-business systems, and scripts. The Exchange admin center has a report that shows whether submissions use Basic Auth or OAuth.
The alternatives
Devices that support OAuth can switch to it. Other options include Microsoft 365 High Volume Email for internal recipients or a relay service.
What we recommend
- Run the SMTP AUTH report in the Exchange admin center
- List the devices and systems that send email
- Update or replace equipment that does not support OAuth
How we can help
Wondering what this means for your organization? Let's talk.
Request a meeting →