Microsoft is retiring Basic Authentication for SMTP AUTH in Exchange Online.
This affects printers, scanners, legacy applications, monitoring systems, embedded devices, and other software that still connects to smtp.office365.com using a username and password.
The final shutdown will not happen immediately, but organizations should start preparing now.
This guide explains:
Microsoft has revised the retirement schedule several times. As of July 2026, the official timeline is:
| Date | What changes |
|---|---|
| Until December 2026 | SMTP AUTH with Basic Authentication continues to work as it does today |
| End of December 2026 | Basic Authentication for SMTP AUTH will be disabled by default in existing tenants |
| After December 2026 | Administrators of existing tenants will temporarily still be able to re-enable it |
| New tenants created after December 2026 | SMTP AUTH with Basic Authentication will be unavailable by default |
| Second half of 2027 | Microsoft plans to announce the final removal date |
The crucial point is that December 2026 is not yet the final removal date.
Existing tenants will initially be able to re-enable Basic Authentication for SMTP AUTH. However, this should be treated as additional migration time—not as a permanent solution.
Microsoft’s current timeline is documented in the official Exchange Team announcement.
The change affects authenticated SMTP client submission using Basic Authentication.
A typical affected configuration looks like this:
SMTP server: smtp.office365.com
Port: 587
Encryption: STARTTLS
Authentication: Username and passwordOAuth-based SMTP AUTH will continue to work. Microsoft is retiring the use of a conventional mailbox username and password for this connection—not the SMTP protocol itself.
App passwords are also not a long-term solution because they still rely on Basic Authentication.
Microsoft already removed Basic Authentication for protocols including IMAP, POP, Exchange Web Services, and Exchange ActiveSync. SMTP AUTH was one of the remaining exceptions.
The retirement does not directly remove every way of sending email through Microsoft 365.
The following methods do not rely on SMTP AUTH with Basic Authentication:
Microsoft documents the differences between client submission, SMTP Relay, and Direct Send in its guide for applications and multifunction devices.
Common examples include:
Some newer devices support OAuth after a firmware update. Older devices may have no upgrade path at all.
Before choosing a replacement, identify which systems still connect to smtp.office365.com using a username and password.
If the system supports OAuth 2.0 for SMTP AUTH, updating its configuration is usually the cleanest solution.
Custom applications can alternatively move to Microsoft Graph where appropriate.
Best for: Supported applications and devices that can be upgraded without disproportionate cost or effort.
Microsoft 365 offers two additional SMTP-based methods that do not use mailbox passwords.
SMTP Relay uses an Exchange Online connector to recognize your infrastructure by a TLS certificate or static public IP address.
It can send to both internal and external recipients and does not require a licensed mailbox.
Direct Send delivers messages to recipients inside your own Microsoft 365 organization. It does not relay messages to external recipients.
Best for: Centrally managed on-premises devices behind a static public IP address, especially when only SMTP sending is required.
You can operate Postfix, Exchange Server, or another SMTP relay that accepts messages from legacy devices and forwards them using a supported upstream method.
The relay can deliver mail itself or pass it to Exchange Online through a connector.
Best for: Organizations with the operational capacity to run mail infrastructure and a large number of centrally managed SMTP devices.
Cloud email providers offer SMTP relay services for application and transactional email.
These services commonly accept conventional SMTP credentials and deliver messages through their own infrastructure.
Best for: External transactional email where Exchange mailbox semantics are not required.
Azure Communication Services Email provides a Microsoft-operated SMTP service for application-generated email.
It supports username-and-password-style SMTP submission. Behind the scenes, the SMTP identity is linked to a Microsoft Entra application and its client secret.
Devices must support TLS 1.2 or later and connect to:
SMTP server: smtp.azurecomm.net
Port: 587
Authentication: SMTP username and Entra application client secretMicrosoft documents the required resources and credentials in its Azure Communication Services SMTP guide.
Best for: Application and device-generated email where a Microsoft-operated transactional sending platform is preferred over Exchange mailbox submission.
lette.io is designed for applications and devices that still require conventional SMTP or IMAP authentication but need to connect to Microsoft 365 using Modern Authentication.
The legacy client connects to lette.io using credentials it understands. lette.io then authenticates securely with Microsoft 365 using OAuth and forwards the protocol traffic.
For SMTP, Exchange Online remains responsible for mailbox-based submission and delivery. For IMAP, the mailbox and long-term message storage remain in Exchange Online.
Best for: Organizations that want Exchange Online to remain their mailbox and delivery platform without operating their own compatibility infrastructure.
| Option | Works with legacy SMTP clients | Exchange Online handles outbound delivery | Legacy IMAP support | Main infrastructure requirement |
|---|---|---|---|---|
| Upgrade to OAuth or Graph | No | Yes | Only with OAuth-capable clients | Application or firmware update |
| Microsoft 365 Relay | Yes | Yes | No | Static IP or certificate, port 25 |
| Self-hosted relay | Yes | Optional | Usually no | Operated mail relay |
| Third-party SMTP service | Yes | No | No | External delivery provider |
| Azure Communication Services | Yes | No | No | Azure and Entra configuration |
| lette.io | Yes | Yes | Yes | lette.io subscription |
The right solution depends on the workload.
Do not wait for the final removal date.
Start by creating an inventory of every system that sends mail through Microsoft 365. For each system, record:
Then select the simplest sustainable option for each workload.
A modern application may move directly to OAuth or Microsoft Graph. A group of local printers may fit Microsoft 365 SMTP Relay. A transactional system may be better suited to Azure Communication Services. A legacy application that must continue using a mailbox may require a compatibility bridge.
No. Microsoft is retiring Basic Authentication for SMTP AUTH, not SMTP itself. SMTP AUTH using OAuth will continue to work.
At the end of December 2026, it will be disabled by default. According to Microsoft’s current announcement, administrators of existing tenants will initially still be able to re-enable it.
The final removal date has not yet been announced.
No. App passwords still rely on Basic Authentication and therefore do not provide a long-term migration path.
Not directly. These methods do not authenticate to smtp.office365.com using a mailbox username and password.
SMTP Relay uses a connector and a certificate or static public IP address. Direct Send is unauthenticated but can deliver only to recipients inside your Microsoft 365 organization.
For outbound application or device email, often yes. However, it is a separate sending platform and does not provide an Exchange Online mailbox, Sent Items, or IMAP access.
The main alternatives are:
The retirement of SMTP Basic Authentication does not mean every legacy device must be replaced immediately. It does mean that continuing to use a mailbox username and password directly with Exchange Online is no longer a sustainable architecture.
The best migration path is the one that matches the actual workload:
The current extension gives organizations more time—but the direction is clear.
If your legacy application or device cannot support OAuth and you want Exchange Online to remain your mailbox and delivery platform, you can start a free lette.io trial or contact us to discuss your scenario.