Microsoft's 365 SMTP Basic Auth Ends in 2026, Is Your Business Ready?

Through January 2027, Microsoft is closing out one of the last legacy login methods in Exchange Online, and the first real enforcement step lands at the end of this year. Here is what is changing, what isn’t, and how to get ahead of it while you still have time. 

First, What Is (and Isn’t) Changing

While this announcement may seem like Microsoft is “shutting down SMTP.” What Microsoft is retiring is Basic authentication for SMTP AUTH client submission, the method where a device or application logs in to Microsoft 365 with a stored username and password in order to send mail. Other ways of getting mail into Exchange Online, including OAuth-based sending and IP-based relay through a connector, are not part of this retirement.

That distinction matters, because it means almost every business has a path forward. The problem is that most don’t know which of their devices and systems are on the wrong side of the line.

The Timeline, Revised

The timeline for these changes has shifted quite a bit since Microsoft first announced the retirement in 2024. They then pushed the target to the first half of 2026, and in January 2026 published a more gradual schedule. The current plan looks like this:

• Now through December 2026: Basic authentication for SMTP AUTH behaves as it always has.
• End of December 2026: Basic authentication is turned off by default for existing tenants. Administrators can still switch it back on.
• After December 2026: Newly created tenants don’t get Basic authentication for SMTP at all. OAuth is the supported method.
• Second half of 2027: Microsoft says it will announce the final removal date, when the option to re-enable goes away.

What Microsoft's Scan-to-Email Update Means for Your Workflow

Despite the frequent changes for this retirement, every business should begin taking steps to move away from this form of authentication. Here are a few examples of what businesses may experience after the final cutoff for SMTP Basic Authentication: 

1. The default flip fails silently. Nobody gets a warning when a copier’s login stops being accepted. You find out when someone needs to send a scan.
2. The timing is awkward. The change lands during the holidays, when IT staff are out, and change freezes are in effect. Problems will surface in the first days of January, when your team is catching up on a backlog of paperwork.
3. The direction has never changed. Dates have moved, but the destination hasn’t. Re-enabling Basic authentication is a temporary bridge, not a plan.

This Change Affects More Than Just Your Copier

Scan-to-email gets the attention because everyone in the office notices when it breaks, but the real exposure is wider. Anything that stores a mailbox password and uses it to send through Microsoft 365 is a candidate:

• Multifunction printers and standalone scanners
• Accounting, ERP, and CRM software that emails invoices, statements, or reports (older on-premises versions are the usual offenders)
• Alarm, monitoring, and building systems that send alerts
• Scheduled scripts and automated jobs someone set up years ago
• Line-of-business apps from vendors who haven’t updated their email settings

If you’d like help with the inventory side, our complimentary Fleet Assessment gives you a clear picture of every device on your network and how it’s being used.

Find Every Sender, Then Pick a Fix

First, find everything that sends email through Microsoft 365 with a saved password. In the Exchange admin center, open Reports, then Mail flow, then SMTP AUTH clients. The Authentication Protocol column shows which senders still use Basic authentication. Rarely used senders can slip through, so also walk the office and ask your software vendors. Our complimentary Fleet Assessment can list every printer and scanner for you.

Next, match each sender to a fix. If your printer or scanner supports OAuth 2.0 (a sign-in method that uses temporary tokens instead of a saved password), update its firmware and switch it over. It is the most secure option, and our post on Microsoft’s scan-to-email update explains how it works.

If your device can’t use OAuth but has a fixed address on your network, ask your IT team to set up an SMTP relay connector, a Microsoft 365 setting that trusts approved network addresses instead of a login. Limit it to those addresses only. Business software that emails invoices or alerts needs either an update from its vendor or a different sending method.

Two shortcuts exist for email that stays inside your company: Direct Send and High Volume Email (HVE). Both only deliver to your own domain, and Microsoft is tightening Direct Send, so treat them as temporary. If a printer is too old for any of this, replacing it, or scanning to SharePoint or a shared folder instead of email, is often simpler. You can also try other methods of troubleshooting scan-to-email issues.

The “Just Turn It Back On” Trap

When December passes and something breaks, the fastest fix will be an administrator re-enabling Basic authentication. It works, and sometimes it is the right call for a sender you discover at the last minute.

But it keeps a stored password on a device and keeps your tenant exposed to the high risks Microsoft is trying to eliminate, and it only delays a decision you will have to make once the final removal date is announced. If you do re-enable it, treat it as a documented exception with an expiration date and an owner, not a permanent setting.

One more thing worth checking: if your tenant has security defaults turned on in Microsoft Entra ID, SMTP AUTH may already be disabled. Some organizations have been running without scan-to-email for a while without realizing the cause.

A Realistic Plan for the Weeks Ahead

There are roughly seven weeks between now and the end of December. Here is one way to use them:

Don’t Let a Default Setting Interrupt Your Workflow

This change is manageable, and the businesses that handle it well will be the ones that started before anything broke. If you’d like a second set of eyes, Cobb can help you inventory your devices, check OAuth compatibility, and choose the right approach for each one, whether that means a firmware update, a relay configuration, or a new machine.

Schedule a call with our team, and we’ll help you get ready before the New Year.