Microsoft has officially revised the clock for the final retirement of Basic Authentication for Client Submission (SMTP AUTH) in Exchange Online. Organizations now have an extended runway to modernize their legacy email workflows, with the first major enforcement milestone pushed to the end of 2026.

The New Timeline for Deprecation

• Now through December 2026: Basic Authentication behavior remains unchanged.
• End of December 2026: Basic Authentication for SMTP AUTH will be disabled by default for all existing tenants. While administrators can still manually re-enable it if necessary, it will no longer be the standard configuration.
• New Tenants (Post-December 2026): For any new tenants created after this date, Basic Auth will be unavailable by default, and OAuth will be the only supported method.
• Second Half of 2027: Microsoft expects to announce the final removal date when Basic Auth will be permanently disabled with no option to re-enable it.

Why You Must Implement These Solutions Now

The shift away from Basic authentication is a critical security necessity, and the extended deadline should be used for validation rather than procrastination.

• Security Vulnerabilities: Basic authentication is a legacy method that sends usernames and passwords in plain text over the network, making them easy targets for credential theft, phishing, and brute-force attacks.
• Modern Protection: OAuth 2.0 (Modern Authentication) uses secure, short-lived access tokens instead of static credentials, significantly reducing the attack surface.
• Operational Risk: Once the final removal occurs, failures will be immediate and silent. If you do not transition, your printers, scanners, and automated scripts will simply stop sending emails without warning.
• No Exceptions: Microsoft has stated there will be no exceptions for legacy devices once the final removal date is reached.

How to Prepare and Implement Solutions

To avoid disruption in your “scan-to-email” workflows and application alerts, you must identify impacted devices and choose a modern alternative.

1. Audit Your Environment

Identify which of your clients are still using Basic authentication by signing into the Exchange Admin Center and viewing the SMTP AUTH Clients Submission Report. This report explicitly lists which users or apps are using “Basic” versus “OAuth”.

2. Transition to OAuth 2.0 (The Preferred Path)

If your device or application supports it, this is the most secure long-term solution.

• For Hardware: Check with your manufacturer (e.g., Epson, HP, Canon) for firmware updates that add OAuth support for SMTP.
• Implementation Example: On Epson devices, you can access the Web Config interface, navigate to Email Server settings, select OAuth2 as the authentication method, and follow the prompts to sign in with a Microsoft account.

3. Configure SMTP Relay (Connector-Based)

If you have a fleet of legacy devices that cannot be updated to support OAuth, you can set up a Microsoft 365 inbound connector. This method authenticates your devices based on their public IP address or a TLS certificate rather than individual mailbox credentials.

4. Utilize “Direct Send” for Internal Needs

If your device only needs to send mail to recipients within your own organization, you can use Direct Send. This involves pointing the device’s SMTP server address to your MX record (e.g., yourdomain-com.mail.protection.outlook.com). Note that this requires adding the device’s public IP to your SPF record and does not support sending to external addresses like Gmail.

5. Explore Dedicated SMTP Relay Services

For legacy systems that cannot support OAuth and lack a static IP for a connector, third-party services like SMTP2GO can act as a bridge. These services continue to support standard SMTP authentication and can route your email through their infrastructure, bypassing Microsoft’s Basic Auth restrictions entirely.

Conclusion

While the December 2026 deadline provides more time, the eventual total removal of Basic Authentication is inevitable. Use this period to audit and modernize your fleet now to ensure your organizational communications remain secure and uninterrupted.

Author: Michael Her