SMTP AUTH in Microsoft 365 deprecated: dates and fixes

Microsoft is turning off SMTP AUTH with basic authentication, meaning a device or app that logs in to Microsoft 365's mail server with a user name and password to send email. From the end of December 2026 it is off by default in existing organisations, though an admin can turn it back on; organisations created after December 2026 won't have it by default, and Microsoft will announce the final removal date in the second half of 2027.

Below are the dates in Microsoft's own words, how to find what in your store still uses it, and what to do about a printer, an app or a helpdesk tool.

The dates, from Microsoft

On 27 January 2026 the Exchange Team published an updated timeline. These four points are quoted from that post:

• "Now to December 2026: SMTP AUTH Basic Authentication behavior remains unchanged."
• "End of December 2026: SMTP AUTH Basic Authentication will be disabled by default for existing tenants. Administrators will still be able to enable it if needed."
• "New tenants created after December 2026: SMTP AUTH Basic Authentication will be unavailable by default. OAuth will be the supported authentication method."
• "Second half of 2027: Microsoft will announce the final removal date for SMTP AUTH Basic Authentication."

A "tenant" is your Microsoft 365 organisation. Microsoft says the timeline applies to tenants in "all cloud environments".

What changed from the earlier plan

If you read about this before, you may have seen other dates. Microsoft's original post from April 2024 planned rejections starting on 1 March 2026 and reaching 100% on 30 April 2026, after an earlier September 2025 date. That post now carries a note that the timeline was revised and points to the January 2026 post. The dates above are the current ones.

The earlier post also says what a blocked client will see once basic authentication is permanently disabled:

550 5.7.30 Basic authentication is not supported for Client Submission.

Existing and new organisations: what changes

Your organisation	Until end of December 2026	After end of December 2026	After the final removal date
Existing tenant	Unchanged	Off by default; an admin can turn it back on	Microsoft hasn't published it yet
New tenant, created after December 2026	—	Unavailable by default; OAuth is the supported method	Microsoft hasn't published it yet

Turning it back on buys time, not a solution. Microsoft's stated direction is OAuth, and the final removal date is coming.

Who this affects

SMTP AUTH, also called authenticated SMTP submission or client SMTP submission, is how things that aren't Outlook send email through Microsoft 365. Microsoft lists the uses:

• POP and IMAP email clients, which use it to send.
• "Applications, reporting servers, and multifunction devices that generate and send email messages."

For a small store, that usually means:

• A printer or scanner that emails scans.
• An app or plugin that sends email from your address: an invoicing tool, a booking system, a contact form.
• A helpdesk or shared inbox tool that sends your replies by logging in to smtp.office365.com with your mailbox's user name and a password.
• An email app set up with IMAP or POP rather than as an Exchange or Microsoft 365 account.

It doesn't affect Outlook itself. Microsoft says "virtually all modern email clients" that connect to Exchange Online, including Outlook, Outlook on the web and the Outlook mobile apps, "don't use SMTP AUTH to send email messages".

Does an app password get around it?

Don't plan on it. Microsoft's page on the basic authentication deprecation states that it "also prevents the use of app passwords with apps that don't support two-step verification". The fix is OAuth or a different sending method, not a different password.

How to find what still uses it

1. Check Microsoft's report. Microsoft said in 2024 that it would update the SMTP AUTH Clients Submission Report in the Exchange admin center to show whether basic authentication or OAuth is used to submit email. Look for anything still on basic authentication.
2. List the mailboxes that allow it. In the Microsoft 365 admin center: Users → Active users → select the user → Mail → Manage email apps. "Authenticated SMTP" checked means the mailbox allows SMTP AUTH.
3. Check every device and app that sends from your domain. If its settings ask for a server, smtp.office365.com, a port (587) and a password, it uses SMTP AUTH. If it signs in through a Microsoft sign-in page instead of a typed password, ask the vendor to confirm that it uses OAuth.

If your organisation uses Security defaults, Microsoft says SMTP AUTH is already disabled, so anything that relies on it would already be failing.

What to do, by device

What sends the email	What to do
An app or helpdesk that supports OAuth	Switch it to OAuth. It keeps using SMTP AUTH, just without a password.
An app that only takes a password	Ask the vendor for their OAuth date. Microsoft's alternatives: an app that supports OAuth, Azure Communication Services Email, or High Volume Email for internal-only mail.
A printer or scanner that emails people inside your business	Microsoft points to High Volume Email for mail to recipients inside your tenant, or to SMTP relay through a connector.
A printer or scanner that emails customers or suppliers	Microsoft points to Azure Communication Services Email, or SMTP relay through a connector with a static IP address or certificate.
An email app using IMAP or POP	Update to a version that supports OAuth (Microsoft names Thunderbird as one), or use Outlook, which doesn't send with SMTP AUTH.

For after the final removal, Microsoft's original post is blunt: "The only remediation for this is to update your client or app to support OAuth, use a different client or app that supports OAuth, or use a different email solution such as High Volume Email or Azure Communication Services for Email."

SMTP relay has conditions of its own. Microsoft's guide for devices says it uses port 25, needs an inbound connector authenticated by a TLS certificate or a static IP address that isn't shared with another organisation, and can't be used to send from a third-party hosted service. If you don't have a static IP address, it isn't an option for you.

If you need more time

For existing organisations, Microsoft says administrators "will still be able to enable it if needed" after December 2026. Today, an admin can allow SMTP AUTH for one mailbox only: Microsoft 365 admin center → Users → Active users → the user → Mail → Manage email apps → tick "Authenticated SMTP" → Save changes. Microsoft recommends keeping SMTP AUTH off for the organisation and on only for mailboxes that still need it.

A note to send your app vendor

Copy this to each vendor whose app sends email from your Microsoft 365 address. Fill in what the app is and which mailbox it uses.

Hi {{vendor_name}},

We send email from {{app_or_device_name}} through Microsoft 365, signed in as {{mailbox_address}} with a user name and password (SMTP AUTH with basic authentication).

Microsoft is disabling SMTP AUTH basic authentication by default for existing tenants at the end of December 2026, and will announce a final removal date in the second half of 2027.

Does {{app_or_device_name}} support OAuth for sending through Microsoft 365? If so, how do we switch? If not, when will it, and what do you recommend until then?

Thanks,

{{your_name}}

Your support inbox and this change

If your support address is on Microsoft 365 and a tool sends your replies, check that tool first: it's the one your customers notice when it stops. Microsoft 365 shared mailboxes covers the Send As permission a tool needs to send from a shared address, and setting up a Shopify support address covers how the pieces fit for a Shopify store.

Corresso is a shared support inbox for small online stores. Your mail stays with your provider: the support address is forwarded to Corresso, and when a person presses Send, the reply goes out from your own address through your Google account or your provider's mail server. With Microsoft 365, that is the kind of sending this article describes, so check it with your admin before the end of December 2026 like any other app. Every draft is written from documents your store approved, and a person always reads it before it goes. How it works, and pricing.