SMTP AUTH basic auth is disabled by default from December 2026

Microsoft's updated timeline (Message Center post MC786329, January 27, 2026) says SMTP AUTH basic authentication stays unchanged until the end of December 2026, is then disabled by default for existing tenants, and that "administrators will still be able to enable it if needed". The final removal date will be announced in the second half of 2027.

What this means in practice

Devices and apps that log in to smtp.office365.com with a username and password stop sending when the default changes, typically with 535 5.7.139 errors.
You can turn basic auth back on, which buys time until Microsoft's final date.
Tenants created after December 2026 do not have basic auth by default.

Step 1: find what still uses basic auth

In the Exchange admin center open Reports, Mail flow, SMTP AUTH clients. The Authentication Protocol column shows "Basic Auth" for senders still using a password. See finding devices that use basic auth.

Step 2: decide per device

Device	Best option
Recent copier with Microsoft 365 OAuth firmware	Update firmware and switch it to OAuth
Older copier, NAS, UPS, alarm panel, script or app	A relay that accepts its password login and sends with OAuth, such as SMTPKeep
Anything that only emails people inside your organization	Direct Send or High Volume Email may be enough

Re-enabling as a stopgap

The existing switches are Set-TransportConfig -SmtpClientAuthenticationDisabled for the tenant and Set-CASMailbox -SmtpClientAuthenticationDisabled per mailbox. Microsoft's notice does not say which setting the December change uses, so check the Message Center for follow-up guidance before relying on it. Security defaults and Conditional Access policies that block legacy authentication still block basic SMTP AUTH regardless of these switches.