Microsoft 365 turns off SMTP Basic auth in December 2026. Here's how to keep your scanner sending.

What changes, and when

Microsoft's Exchange team published this timeline on January 27, 2026. It replaces the earlier plan to cut Basic auth off between March and April 2026, which Microsoft put on hold, so pages that still quote spring 2026 are out of date.

Source: Updated Exchange Online SMTP AUTH Basic Authentication Deprecation Timeline (Exchange Team Blog). Dates have moved before, so check your tenant's Message Center (MC786329) for the dates that apply to you.

Are you affected?

Check the SMTP AUTH clients report

This is the quickest way to see everything in your tenant that still sends with a username and password.

1. Open the Exchange admin center and go to Reports > Mail flow > SMTP AUTH clients.
2. The report shows the last 7 days. Widen the date range (up to 90 days) so you catch things that only send once a month, like statements or backup reports.
3. Look at the Authentication Protocol column. Basic Auth means that sender will be affected. Modern Auth means it already uses OAuth and is fine.
4. Select Export to save the list. Each sender address is a device, app or script you need to find.

Microsoft's guide: SMTP AUTH clients report in the new EAC.

Or look at the device's email settings

If a device or app has these settings, it almost certainly uses SMTP AUTH with Basic auth:

• Server (or "smart host"): smtp.office365.com
• Port: 587 (sometimes 25)
• A Microsoft 365 username and password typed into the device

Devices that already send through your domain's MX endpoint (something like yourdomain-com.mail.protection.outlook.com) on port 25 use a connector or Direct Send, not SMTP AUTH. This change doesn't affect them. (Microsoft has said separately that it's working on an option to turn Direct Send off by default. That's a different change.)

What usually breaks

• Scan-to-email on copiers and multifunction printers. This is the most common one.
• Alarm, access-control and building systems that email alerts.
• Accounting, ERP and line-of-business apps that email invoices, statements or reminders.
• Scripts and scheduled jobs that send reports or alerts.
• Website mailers, like WordPress SMTP plugins set up with a Microsoft 365 mailbox.
• NAS, UPS and monitoring tools that email warnings.

Use the printable device checklist to list yours and track the fix for each one.

Fix 1: Turn it back on (for now)

Microsoft says admins will be able to enable Basic auth for SMTP AUTH again after the December change. As of October 26, 2026, Microsoft hasn't said which setting does that. We'll update this section when they do.

Until then, these are the SMTP AUTH settings Microsoft documents today. They turn the SMTP AUTH protocol on or off, and they may not be the exact switch Microsoft uses for the December change:

• For one mailbox: in the Microsoft 365 admin center, go to Users > Active users, select the user, then Mail > Manage email apps, and check Authenticated SMTP.
• For one mailbox, in PowerShell: Set-CASMailbox -Identity scanner@yourdomain.com -SmtpClientAuthenticationDisabled $false
• For the whole organization: Microsoft recommends leaving SMTP AUTH off for the organization and turning it on only for the mailboxes that need it.

Two things that block SMTP AUTH even when it's turned on:

• Security defaults in Microsoft Entra ID. They block Basic auth, so a device that signs in with a password can't send.
• Authentication policies that block Basic auth for SMTP.

Microsoft's guide: Enable or disable SMTP AUTH in Exchange Online.

Treat this as time, not a fix. Microsoft will announce a final removal date in the second half of 2027.

Fix 2: Send through an SMTP relay connector

This is usually the best fit for a copier or other device sitting in your office. The device stops signing in as a user. Instead, Microsoft 365 recognizes your office's public IP address (or a certificate) through an inbound connector.

On the device:

• Server: your domain's MX endpoint, for example yourdomain-com.mail.protection.outlook.com (find it in the Microsoft 365 admin center under Settings > Domains > your domain > DNS records)
• Port: 25
• TLS: on
• From address: any address in your domain. It doesn't need a mailbox.

In Microsoft 365:

1. In the Exchange admin center, go to Mail flow > Connectors > Add a connector.
2. Connection from: Your organization's email server.
3. Choose how Microsoft 365 recognizes the device: by your office's static public IP address, or by a certificate that names your domain.
4. Add that IP address to your domain's SPF record, so the mail doesn't land in junk.
5. Send a test from the device.

What to know first:

• You need a static public IP that isn't shared with other organizations, unless you use a certificate.
• Port 25 must be open. Some internet providers block it.
• It can't relay from third-party hosted services such as Azure.
• Messages don't show up in a Sent Items folder.

Microsoft's guide: Set up a multifunction device or application to send email (SMTP relay section).

Fix 3: Switch the device or app to OAuth

OAuth (Microsoft calls it modern authentication) lets the device keep using smtp.office365.com and keep sending from a real mailbox, without a stored password.

• Copiers and off-the-shelf apps: check with the vendor first. Many have added a "Microsoft 365" or "OAuth" sign-in option in a firmware or app update. If yours has, follow the vendor's steps. Usually you sign in once and you're done.
• Your own scripts and apps: register the app in Microsoft Entra ID and request the SMTP.Send permission (signing in as a user) or SMTP.SendAsApp (running unattended). Unattended apps also need an admin to register the app's service principal in Exchange Online and grant it access to the sending mailbox.

Microsoft's guide: Authenticate an IMAP, POP or SMTP connection using OAuth.

After the switch, the device shows up as Modern Auth in the SMTP AUTH clients report.

Other options Microsoft lists

• High Volume Email: for mail sent only to people inside your organization.
• Azure Communication Services Email: for mail to people inside and outside your organization.
• Your own on-premises mail server, if you still have one, as the relay.
• Direct Send: only reaches mailboxes in your own tenant, and Microsoft says most customers don't need it.

Details for each: Microsoft's comparison of sending options.

Which fix should you pick?

Before the end of December

1. Run the SMTP AUTH clients report for the last 90 days and export it.
2. Match every Basic Auth sender to a device, app or script.
3. Pick a fix for each, using the device checklist.
4. Test each one after the change.
5. Check Microsoft's timeline again in December, in case the date moves.