What SMTP AUTH is, and what is changing
SMTP AUTH — also called client submission — is the simple way a device or application sends email: it connects to your mail server, signs in with a username and password, and hands the message over. Multifunction printers, scanners, franking machines, accounts packages, line-of-business software and older website plugins very often work this way.
Microsoft has been removing “basic authentication” — plain username and password — from Exchange Online for years, in favour of modern authentication (OAuth). SMTP AUTH was the last major holdout because so many devices depend on it. Microsoft originally planned to switch it off in 2025 and then in spring 2026, and pushed it back both times after customer feedback.
The current timeline
- Until the end of December 2026: SMTP AUTH with basic authentication keeps working in Exchange Online.
- End of December 2026: Microsoft disables it by default for existing tenants. Administrators can re-enable it to buy time.
- From January 2027: new Microsoft 365 tenants cannot use basic authentication for SMTP AUTH at all.
- Second half of 2027: Microsoft expects to announce the final date after which it will no longer be available.
The practical risk is a quiet Monday in January when scan-to-email stops working, invoices stop going out from the accounts system, and nobody connects it to a change made in Microsoft 365 over Christmas.
How to find out if you are affected
- List every device and system that sends email: printers and scanners, accounts and payroll software, CRM, website contact forms, alarm and building systems.
- For each one, find out how it sends. If its settings show smtp.office365.com on port 587 with a username and password, it is using SMTP AUTH with basic authentication.
- Check whether the device or software supports OAuth or “modern authentication” for email. Newer firmware often does.
Your options
- Update to OAuth. The cleanest fix. Many current printers and applications now support signing in to Microsoft 365 with OAuth. Check for firmware or software updates first.
- Use an SMTP relay connector. Exchange Online can accept mail from your office’s static public IP address through a connector, without a username and password. It suits devices on a fixed office connection.
- Use Direct Send for devices that only email people inside your organisation — they deliver straight to your Microsoft 365 mail server. It is limited, and increasingly locked down for security reasons, so check it fits.
- Use a dedicated sending service for applications that send a lot of mail, such as a transactional email provider.
- Re-enable basic authentication temporarily after December 2026, as Microsoft allows for now. Treat it as breathing space, not a fix: the final removal date is coming.
Whichever route you take, check that your SPF record includes whatever now sends mail for your domain, or the mail will start landing in junk. Our email security checker shows your current SPF.
What about hosted Exchange?
This change applies to Microsoft’s Exchange Online. On MyExchangeServer, devices and applications can continue to send through authenticated SMTP to our Exchange Server SE platform, and we help set up scanners and line-of-business systems as part of every migration. If scan-to-email is critical to how your office works and you are weighing up your options, it is worth a conversation.