SMTP AUTH basic authentication retirement in Exchange Online

Copiers, scanners and many older applications send email by logging in to smtp.office365.com on port 587 with a username and password. That is "SMTP AUTH with basic authentication". Microsoft is retiring it.

The timeline

When	What happens
Now to December 2026	No change. Basic auth for SMTP AUTH keeps working where it is enabled.
End of December 2026	Disabled by default for existing tenants. Administrators can still turn it back on.
Tenants created after December 2026	Basic auth for SMTP AUTH is unavailable by default. OAuth is the supported method.
Second half of 2027	Microsoft announces the final removal date, after which it cannot be re-enabled.

Source: Microsoft 365 Message Center post MC786329, last updated January 27, 2026.

What breaks

Scan-to-email on multifunction printers and copiers.
Alerts from NAS devices, UPS units, alarm panels, building systems and monitoring tools.
Line-of-business applications, scripts (Send-MailMessage, Python smtplib) and website contact forms that send through Microsoft 365 with a password.

When it stops working, devices usually show a generic "send failed" or an authentication error such as 535 5.7.139, or the message bounces with 550 5.7.30.

Your options

Option	Works for	Catch
OAuth SMTP on the device	Recent devices whose firmware supports Microsoft 365 OAuth	Many installed copiers will never get that firmware
Exchange connector relay	Sites with a static public IP or a certificate	Setup per site; no per-device logins
Direct Send	Mail to people inside your organization	Cannot send to external recipients
High Volume Email	Internal recipients	Internal only; preview service
Third-party sending service	Any recipient	Mail leaves your tenant; DNS changes per domain
SMTPKeep	Any device that does authenticated SMTP over TLS, any recipient	Paid service ($10 per tenant per month)