Exchange Online turns off SMTP sending with username and password at the end of December 2026

Many devices and applications send mail through Exchange Online with a username and password (SMTP AUTH with basic authentication). Microsoft will disable it by default at the end of December 2026, because a password alone is easy to steal and reuse.

What changes

• At the end of December 2026, SMTP AUTH basic authentication is disabled by default in existing tenants.
• New tenants created after December 2026 do not have it available by default.
• Sending with OAuth keeps working. What stops working is sending with a username and password.
• Microsoft will announce the final removal date in the second half of 2027.

Since when

End of December 2026. Microsoft first announced September 2025, then March and April 2026; in January 2026 it moved the schedule to this date.

Who it affects

• Multifunction printers and scanners that scan to email.
• Systems such as ERP, invoicing, cameras or alarms that send alerts by email with a Microsoft 365 account.
• Scripts and in-house applications that use SMTP with a password.

What to do

1. In the Exchange admin center, open the SMTP AUTH clients report (Reports, Mail flow): the protocol column shows who uses basic authentication.
2. For each device or system, pick a path: move to OAuth if it supports it, use an Exchange Online SMTP relay connector, or a sending service such as Azure Communication Services.
3. Fix what cannot fail first: invoicing and customer notifications.
4. Do not count on turning it back on: the final removal date has not been announced yet.

Let’s review what sends mail with a password in your tenant.

Microsoft sources:

• https://techcommunity.microsoft.com/blog/exchange/exchange-online-to-retire-basic-auth-for-client-submission-smtp-auth/4114750
• https://learn.microsoft.com/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission