SMTP AUTH basic authentication in Exchange Online tends to sit in the background, mostly forgotten until something stops working. In a lot of the environments I review, it is still there behind older line-of-business apps, networked printer/scanners or quick PowerShell scripts that use Send-MailMessage. Microsoft switched off basic auth for all other Exchange protocols by the end of 2022, but SMTP AUTH basic authentication kept running. That is now changing. In April 2024 Microsoft set a firm retirement date, and SMTP AUTH basic authentication for client submission will be gone in September 2025 (Exchange Online to retire Basic Auth for Client Submission (SMTP AUTH)). If you still depend on the old username/password method, you need to plan a replacement.

Printers, legacy apps and scripts still depend on SMTP AUTH basic authentication

You will usually know the candidates right away. Multifunction printers and scanners that email scans, older business systems that send reports or notifications, and automation scripts built around SMTP. For years, SMTP AUTH with a username and password was the easiest way to get mail out, so many projects simply went with whatever worked. Microsoft has been pushing modern authentication and newer methods for a long time. In day-to-day IT, though, this kind of change kept getting pushed down the list until a hard deadline showed up.

Several modern delivery options replace the old SMTP submission

Now that the end of SMTP AUTH basic authentication has a date, the remaining use cases need to be dealt with. Which option fits depends on your scenario:

  • SMTP AUTH with OAuth: Exchange Online supports it, but so far only some devices and apps can use it.
  • High Volume Email (Preview): A newer Microsoft service for bulk mailings and system-generated messages.
  • Direct Send or SMTP Relay Connector: Many printers and similar devices can use direct send (no authentication, the sender has to be internal) or an authenticated SMTP relay from a fixed IP (setup guide).
  • Azure Communication Services: For modern apps, this Azure platform is the option that will hold up long term.

The right choice comes down to what your device or app can actually do. Direct send often covers plain scan-to-email. Apps that need to deliver to external recipients, or more advanced setups, take more work. I'd start with the official SMTP AUTH documentation.

The SMTP AUTH clients report shows where you still need to act

In mid-sized and large environments, finding every last SMTP AUTH basic authentication user is rarely easy. The Exchange admin center has the SMTP AUTH clients report, which lists the mailboxes that recently authenticated with SMTP AUTH. In my experience it regularly turns up service accounts and devices nobody remembered. I strongly recommend disabling SMTP AUTH at the tenant level and then allowing it per mailbox only where you really can't avoid it. This PowerShell command flips the global switch:

Set-TransportConfig -SmtpClientAuthenticationDisabled $true

After that, SMTP AUTH is blocked by default everywhere, and you can still allow it for individual mailboxes when needed. Be aware that some devices only show vague error messages once SMTP AUTH stops working.

Pro tip: Check the SMTP AUTH clients report before you disable anything. Write down which devices and apps are using it so critical workflows don't break without warning. A scan-to-email setup or an invoicing system failing in production is not something you want to discover after the fact.

A simple diagram shows the three submission paths

To make the change easier to picture, I put together a small flowchart of the different SMTP submission paths: classic SMTP AUTH basic authentication, the newer OAuth-based submission and direct send. Here is the Mermaid diagram for quick reference:

flowchart TD
    Device["Device / App"] --> AuthBasic["SMTP AUTH Basic Auth"]
    Device --> AuthOAuth["SMTP AUTH OAuth"]
    Device --> DirectSend["Direct Send"]
    AuthBasic --> ExO["Exchange Online"]
    AuthOAuth --> ExO
    DirectSend --> ExO
    ExO --> Recipient["Recipient"]

Figure: Different email submission paths with Exchange Online

I recommend starting the migration while you still have options

I've watched plenty of organizations underestimate what the retirement of SMTP AUTH basic authentication means for them, mostly because it is such a quiet piece of legacy. Printers, scripts and apps keep sending mail without complaint, right up to the day they stop. If you haven't started migrating yet, start now. The teams that move early have smoother transitions and fewer outages. If you are already modernizing Microsoft 365 workloads, put the SMTP AUTH replacement on that list and get it done well before September 2025. And if mail flow security is also on your plate, my post on SPF, DKIM, and DMARC in Exchange Online may help.