Exchange Online deadline

SMTP AUTH Retirement: What Will Break and What to Do

By the MMM team — November 4, 2026

The SMTP AUTH retirement ends Basic authentication — a mailbox username and password — for mail submitted to smtp.office365.com. At the end of December 2026, Exchange Online turns it off by default in existing tenants. Admins can still switch it back on, and Microsoft will announce the final removal date in the second half of 2027. Outlook keeps working. What stops sending is everything that signs in with a stored password: scan-to-email copiers, line-of-business and ERP apps, monitoring alerts, scripts, and Power Automate or Logic Apps flows built on the SMTP connector.

This guide shows how to find those senders, including the ones hidden inside flows, and how to choose a replacement for each: OAuth, High Volume Email, Azure Communication Services Email or a relay connector. If your mailboxes still live on Exchange Server on premises, the route is different; our page on moving from Exchange Server to Exchange Online covers that. Every Microsoft statement below was checked against Microsoft’s documentation on November 4, 2026.

What is changing, and when?

Basic authentication for SMTP AUTH client submission is disabled by default for existing Exchange Online tenants at the end of December 2026. Administrators can still turn it back on. Tenants created after December 2026 get no Basic auth for SMTP AUTH by default; OAuth is the supported method. The final removal date follows in the second half of 2027.

Those dates come from the Exchange team’s updated SMTP AUTH Basic authentication deprecation timeline (opens in new tab), last revised on January 29, 2026, which replaced an earlier schedule. SMTP AUTH itself is not going away: a sender that authenticates with OAuth keeps working. Two things may already have done the work for you. Microsoft’s page on enabling or disabling SMTP AUTH in Exchange Online (opens in new tab) says Security defaults in Microsoft Entra ID disables SMTP AUTH outright, and its device guidance notes that SMTP AUTH has been off for organizations created after January 2020 unless someone enabled it per mailbox. In a newer tenant, then, every sender that works today was switched on deliberately, one mailbox at a time — which tells you exactly where to look.

What will stop sending?

Anything that submits mail to smtp.office365.com on port 587 or 25 with a mailbox username and password. In practice that means copiers and scanners, line-of-business and ERP applications, website contact forms, backup and monitoring alerts, PowerShell scripts, POP and IMAP mail clients, and SMTP connector actions in Power Automate and Azure Logic Apps.

The failure is quiet. A copier that can no longer authenticate shows an error on its own panel, if anywhere, and the first person to notice is the one waiting for a scan that never arrives. An invoice run from an ERP system or a nightly “backup failed” alert simply stops, and silence looks exactly like everything being fine. That is the case for finding the senders in November rather than in the first week of January.

How do you find every sender before December?

Start with the SMTP AUTH clients report in the new Exchange admin center, which now shows the authentication protocol each sender uses. Then list the mailboxes with SMTP AUTH switched on individually, and search your flows and Logic Apps for the SMTP connector. Together those three lists cover most senders; devices and vendor apps cover the rest.

1. Read the SMTP AUTH clients report. Note every account still submitting with Basic authentication. Microsoft says the Authentication Protocol column takes 90 days to build up data, so check the report’s date range before trusting an empty result.
2. List the per-mailbox exceptions. The mailbox setting overrides the organization setting, so check both: Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled for the tenant, and Get-CASMailbox -ResultSize unlimited | where {$_.SmtpClientAuthenticationDisabled -eq $false} for mailboxes enabled individually. Each one is usually a device or an app.
3. Search your automation. In Power Platform, use your connector inventory (the Center of Excellence Starter Kit records it) to find flows using the SMTP connector. In Azure, look for SMTP API connections in each Logic Apps resource group.
4. Check the devices. Open the admin page of each copier and scanner and note its SMTP server, port and sign-in account.
5. Ask the vendors. For each line-of-business or ERP app, find out whether your installed version can send with OAuth, and what upgrade it needs if not.

Which replacement fits each sender: OAuth, HVE, ACS or a relay connector?

Choose by where the mail goes and what the sender can do. If the app supports OAuth, keep SMTP AUTH and change how it signs in. If it only emails people inside your organization, High Volume Email fits. If it emails customers or suppliers, use Azure Communication Services Email or a relay connector. Flows should stop using SMTP altogether.

Microsoft’s guide to setting up a multifunction device or application to send email (opens in new tab) lays out the same split: High Volume Email for internal recipients, Azure Communication Services Email for internal and external ones, and relay where neither works. HVE is where most scanners land, because many older devices cannot do OAuth at all, and Microsoft’s High Volume Email documentation (opens in new tab) still lists Basic authentication as supported on its own endpoint while recommending OAuth. The trap is the scanner that also sends to an outside accountant: HVE will not deliver that, so it needs relay instead. Avoid moving anything to Direct Send as a shortcut; it cannot reach external recipients either, and Microsoft says it is working on an option to disable it by default.

What should you do about Power Automate and Logic Apps flows?

Replace every SMTP connector action that signs in to smtp.office365.com with the Office 365 Outlook connector’s Send an email (V2) action, which uses a signed-in connection instead of SMTP AUTH. Decide who owns that connection first: a connection tied to someone who later leaves is the next outage, so use a service account or send from a shared mailbox.

This is the part the Microsoft announcement does not walk through. In Power Automate the change is usually mechanical — swap the action, map the same To, Subject and Body fields, test once — but attachments, HTML bodies and custom From addresses each need a second look, because the Outlook connector handles them differently. Logic Apps is less forgiving: the Outlook connector needs an interactive sign-in to authorize, which some unattended integrations were built to avoid. For those, an HTTP action calling Microsoft Graph with an app registration, limited to the mailboxes it is allowed to send from, is the cleaner replacement. Our Azure Logic Apps consulting services cover that rebuild, and flow inventories and rewrites run under our Power Automate consulting practice.

Should you just re-enable Basic auth after December?

Only as a short bridge for a sender you have already found and scheduled to fix. Microsoft lets administrators re-enable it after the default change, but the final removal date is due in the second half of 2027, and a mailbox password stored in a copier or a config file is a credential worth retiring anyway.

If you need the bridge, follow Microsoft’s own recommendation: keep SMTP AUTH off for the organization and enable it only on the named mailboxes that still need it. Write each exception down with an owner and a target date, so the list shrinks rather than settles in. For the cleanup itself, we handle the job as a fixed-fee project: inventory every sender, move scanners to High Volume Email or relay, rewrite the flows and Logic Apps, switch capable apps to OAuth, and test each route before the default changes. Like all our work, it is scoped and priced in writing before anything starts, delivered by senior US-based Microsoft engineers, typically within 2–4 weeks, with 30 days of hypercare afterwards. See how the fixed-fee process works.