Exchange Online: Basic Auth retirement for SMTP AUTH by April 2026

Introduction

In April 2026 Exchange Online will complete the Basic Authentication retirement process that began in 2019. The last remaining exception, Client Submission (SMTP AUTH), will finally be moved to modern authentication protocols.

This change will affect applications, multifunction devices, monitoring systems and every service that currently sends email via SMTP AUTH with plain-text credentials. Administrators need to act now to avoid service disruption.

What is Basic Authentication for SMTP AUTH

Basic Authentication for Client Submission (SMTP AUTH) is a legacy authentication method that sends the username and password over the network. Although normally protected by TLS, this method has significant weaknesses compared with modern protocols.

Why Microsoft is removing Basic Auth

Since 2019 Exchange Online has been working to retire Basic Authentication, a process completed in 2022 for every protocol except SMTP AUTH. Microsoft is now removing this last exception too, in order to:

• Eliminate vulnerabilities to credential theft, phishing and brute-force attacks
• Prevent the transmission of easily intercepted credentials
• Address the lack of native support for Multi-Factor Authentication
• Align with modern security standards based on OAuth 2.0

Retirement timeline

Microsoft updated the timeline in June 2025:

Affected endpoints

• smtp.office365.com
• smtp-legacy.office365.com

Error message after retirement

550 5.7.30 Basic authentication is not supported for Client Submission.

Checking Basic Auth usage

SMTP AUTH Clients report in the Exchange Admin Center

1. Sign in to the Exchange admin center
2. Go to Reports > Mail flow
3. Open the “SMTP AUTH clients submission report”
4. Check the “Authentication Protocol” column:
   • “Modern Authentication” = OAuth (will not be affected) ✅
   • “Basic Authentication” = needs migrating ⚠️

This report lets you identify exactly which clients, applications or devices need updating.

Migration options

Microsoft offers several options depending on the use case:

Option 1: OAuth with SMTP AUTH (Recommended)

The best solution if your client or application supports OAuth.

Implementation guide:

• Authenticate an IMAP, POP or SMTP connection using OAuth

✅ Advantages:

• Maximum security with short-lived tokens
• Native MFA support
• No additional cost
• Long-term solution

📋 Requirements:

• Application registration in Microsoft Entra ID
• Implementation of the OAuth 2.0 flow
• Configuration of the appropriate permissions

Option 2: High Volume Email for Microsoft 365 (HVE)

Use case: Internal email only within the tenant (between users in the same organisation).

High Volume Email (currently in Public Preview) is designed for line-of-business applications and high-volume submission sending internal messages in Exchange Online.

✅ Advantages:

• Continued support for Basic Authentication
• Optimised for high volume
• Included in Microsoft 365
• An alternative that lets you decommission on-premises servers

⚠️ Limitations:

• Only for email internal to the tenant
• Requires onboarding and configuration

Guide: Manage high volume emails for Microsoft 365

Option 3: Azure Communication Services for Email

Use case: Email both internal and external to the tenant.

A centralised platform for managing outbound email for B2C communications, with SMTP support and advanced analytics.

✅ Advantages:

• Supports internal and external recipients
• Managed platform with insights
• Greater control over communications
• Enterprise scalability

💰 Considerations:

• Separate Azure service (pay-per-use)
• Requires configuration in the Azure Portal
• Ideal for B2C and transactional scenarios

Guide: Email SMTP as service overview in Azure Communication Services

Option 4: Exchange Server On-Premises (Hybrid)

Use case: Organisations with on-premises Exchange Server in a hybrid configuration.

Authenticate against on-premises Exchange, or configure a Receive connector with anonymous relay.

Configuration: Allow anonymous relay on Exchange servers

⚠️ Considerations:

• Requires on-premises infrastructure
• Maintenance and management of local servers
• A temporary solution if you’re planning a full cloud migration

Comparing the options

FAQ - Frequently asked questions

❓ Why this change?
To strengthen the protection of the service and of data against the growing risks of Basic Authentication.

❓ Can I re-enable Basic Auth after March 2026?
No. It won’t be possible, and Microsoft support cannot grant exceptions.

❓ Are there any exceptions?
No. Microsoft does not offer exceptions and Basic Auth will be permanently disabled.

❓ Are the smtp-mail.outlook.com or outlook.office365.com endpoints affected?
No. These endpoints are for OAuth 2.0 applications and will not be affected.

❓ Will my multifunction device still work?
Check with the manufacturer whether it supports OAuth 2.0. If not, consider HVE (internal email only) or Azure Communication Services.

❓ What happens if I do nothing?
From 1 March 2026 you’ll start seeing gradual rejections, reaching 100% by 30 April 2026.

Checklist for administrators

• Check Basic Auth usage via the SMTP AUTH report in the EAC
• Identify all devices/applications sending via SMTP AUTH
• Choose the appropriate solution for each use case
• Implement and test the chosen solution in a test environment
• Monitor the report to confirm the switch to “Modern Authentication”
• Complete the migration by February 2026

Conclusions

The retirement of Basic Authentication for SMTP AUTH is the final piece of a process that began in 2019. Administrators have until April 2026, but it’s essential to act now to:

1. Identify every system that uses Basic Auth
2. Assess the most suitable solution (OAuth is the best choice where possible)
3. Test the implementations
4. Migrate before the gradual rollout begins in March 2026

There are no exceptions and no option to postpone: planning early is essential to avoid service disruption.

References:

• Exchange Online to retire Basic auth for Client Submission (SMTP AUTH)
• Deprecation of Basic authentication in Exchange Online