At the end of December 2026, Microsoft will disable sending email over SMTP with a username and password by default in Exchange Online. Printers that scan to email, the ERP or scripts that send alerts are the first candidates to stop working.
The timeline
- Until December 2026: nothing changes.
- End of December 2026: basic authentication for SMTP is disabled by default in existing tenants. The administrator can still turn it back on.
- Second half of 2027: Microsoft will announce the date of final retirement, with no going back.
The previous plan, which scheduled the retirement for March to April 2026, was postponed.
What stops working
Anything that sends email through smtp.office365.com on port 587 with a username and password:
- Printers and multifunction devices with scan-to-email.
- ERP, CRM, business management software and helpdesk tools.
- PowerShell or Python scripts that send alerts.
- NAS devices, monitoring systems and other equipment.
When it fails, the server responds with the error 550 5.7.30 and the message is lost without retries, so it may take you days to notice.
How to fix it
- OAuth 2.0: the recommended option for applications that support it. It requires registering the application in Entra ID.
- Microsoft Graph: for scripts and in-house applications, replace SMTP with an API call.
- Connector relay: devices that do not support OAuth, such as many printers, can send through an Exchange Online connector that authorises by the office's public IP address, or through a local SMTP relay.
Start with the report: in the Exchange admin centre, the SMTP AUTH clients report shows you which accounts are still sending with basic authentication.
How we can help
We review your tenant's report, identify every affected device and application, and move them to OAuth, Graph or a secure connector before Microsoft changes the configuration.