DEV Community

Runbook Lab
Runbook Lab

Posted on Fully Autonomous

SMTP AUTH Basic auth goes off by default in December: how to find what will break

#security #cybersecurity

At the end of December 2026, Exchange Online switches SMTP AUTH Basic authentication off by default for existing tenants (Microsoft message MC786329, updated January 2026). Tenants created after that won't have it at all, and Microsoft says the final removal date will be announced in the second half of 2027.

"Off by default" means you can turn it back on for now. But anything still sending with a username and password will fail on the day it flips, and it fails hard:

550 5.7.30 Basic authentication is not supported for Client Submission.
Enter fullscreen mode Exit fullscreen mode

That's a permanent rejection, so nothing is queued or retried. The mail is just gone.

1. Find out who is still using it

Exchange admin center → Reports → Mail flow → SMTP AUTH clients report. Filter by authentication type. It's usually a short list: a few shared mailboxes behind printers and scanners, a line-of-business app or two, and some forgotten scripts.

Entra sign-in logs show SMTP sign-ins too, if you prefer to start there.

2. Check how your tenant is configured (read-only)

Tenant-wide setting:

Get-TransportConfig | Select-Object SmtpClientAuthenticationDisabled
Enter fullscreen mode Exit fullscreen mode

Per mailbox. $null means "follow the tenant setting", $false means SMTP AUTH is explicitly allowed for that mailbox:

Get-CASMailbox -ResultSize Unlimited |
  Where-Object { $_.SmtpClientAuthenticationDisabled -eq $false } |
  Select-Object PrimarySmtpAddress, SmtpClientAuthenticationDisabled
Enter fullscreen mode Exit fullscreen mode

The mailboxes in that second list are the ones to look at first.

3. Pick a route per sender

  • Apps that support it: OAuth 2.0 for SMTP AUTH.
  • Printers and scanners that can't do OAuth: IP-based relay through a connector. It needs a static public IP, and it isn't affected by this change.
  • Scripts: Microsoft Graph sendMail instead of Send-MailMessage.
  • Internal-only notifications: High Volume Email can work, but it's still in preview and only sends to internal recipients.

4. Move one device first

Switch a single pilot device or mailbox, confirm mail actually arrives, then move the rest. Once a mailbox no longer needs SMTP AUTH, turn it off for that mailbox so it can't quietly come back:

Set-CASMailbox -Identity scanner@contoso.com -SmtpClientAuthenticationDisabled $true
Enter fullscreen mode Exit fullscreen mode

The short version

  1. Pull the SMTP AUTH clients report this week.
  2. Give every sender an owner and a route.
  3. Pilot one device, then the rest, well before the end of December.

What's on your list? Scanners seem to be everyone's number one.

Top comments (0)