1. Understand what Microsoft has actually announced
Microsoft's Exchange Team published a revised timetable on 27 January 2026 and updated the post on 29 January. It says SMTP AUTH Basic authentication behaviour remains unchanged until December 2026. At the end of December it will be disabled by default for existing tenants, with administrators still able to enable it if needed. New tenants created after December will have it unavailable by default, with OAuth the supported authentication method.
Microsoft says it will announce the final removal date in the second half of 2027. That is not a statement that removal itself happens then. Older notices describing permanent removal in March or April 2026 have been superseded. Check your tenant's Message centre for implementation notices as well as the official timetable.
This concerns Basic authentication for SMTP client submission. It does not mean Microsoft 365 email, SMTP itself or every scan to email connection is being switched off.
Microsoft Exchange Team: revised SMTP AUTH timetable, January 2026
2. Find the devices and applications that depend on it
Ask the person who manages IT to review the SMTP AUTH Clients report in the Exchange admin centre under Reports, then Mail flow. Microsoft documents an Authentication Protocol column distinguishing Basic Auth from Modern Auth, together with sender and TLS information. The report defaults to seven days and supports a range of up to 90 days. An empty short period does not prove there are no dependencies.
Match the report to actual equipment and software. Include reception scanners, workshop devices, finance applications, website systems, monitoring alerts and monthly reports. A report of SMTP AUTH use will not inventory connector based relay or every other sending route, so supplier records and device settings still matter.
Keep credentials out of the inventory. Record the device, owner, sender address, sending method, recipients and supplier contact, not passwords. Include occasional jobs that may not have run during the reporting period.
3. Choose a route that fits the real workflow
Microsoft supports several sending methods. SMTP AUTH can use OAuth, a token based sign in method, where the device supports it. Connector based SMTP relay can use a TLS certificate or an appropriate static public IP address and requires port 25. Direct Send cannot deliver to external recipients. These methods are not interchangeable settings.
A connector based relay without a mailbox password is not automatically using Basic authentication. Equally, encrypted transport does not turn a password based sign in into OAuth. Confirm the actual configuration rather than judging it from the port number alone.
Ask the equipment supplier whether the exact model and firmware support the proposed method. Test a school office scanner that only sends internally differently from an accounts system that emails customers. Include security, delivery requirements, maintenance and any licensing or service cost in the decision.
Microsoft: sending email from multifunction devices and applications
4. Do not weaken everyone else's security to fix one scanner
Microsoft recommends disabling SMTP AUTH where it is not needed and limiting necessary use to the relevant mailboxes. Its documentation also explains that Security defaults and authentication policies can restrict use. A mailbox checkbox alone does not override every policy.
Do not switch off Security defaults or multifactor authentication across the organisation as a routine scanner fix. If an exception is genuinely required, have the responsible administrator assess the risk, scope it narrowly, document it and set a review date. Prefer a supported replacement workflow over an indefinite exception.
Never put a director's, headteacher's or administrator's everyday credentials into a shared printer. Protect the device's management access, keep its firmware supported and remove obsolete sending accounts once the new method works.
Microsoft: enable or disable SMTP AUTH, updated September 2026
5. Test receipt and collect useful evidence
Use a harmless test page, not a real pupil record or customer document. Test an internal recipient and, if the workflow requires it, an authorised external recipient. Check the attachment opens, the sender is correct and the message arrives where expected rather than in junk or quarantine.
If sending fails, record the exact time, sender, recipient and device error. Ask IT to compare the device's sending log with Exchange Online message trace where applicable. No trace result alone does not identify the cause: a connection or authentication failure may occur before Microsoft accepts a message.
When reviewing an existing relay, confirm whether a broadband change or backup connection altered its public IP address. Preserve the current settings securely before making controlled changes, and do not change several unrelated settings at once. Keep an approved temporary way to move documents if the test fails.
6. A practical checklist before the Christmas break
Bury I.T. Support Ltd can review scanner and application email settings, identify dependencies and coordinate a controlled change with your equipment or software supplier. We support businesses and schools across Bury, Greater Manchester and Lancashire.
The aim is dependable document delivery with a clear owner and a supported configuration, not an unnecessary printer purchase. Official sources were checked on 9 November 2026.
- List every scanner, application and automated job that sends email.
- Identify the sending method and whether Basic authentication is actually used.
- Review enough reporting history to include occasional and monthly processes.
- Check supplier support, firmware and the intended replacement route.
- Test internal and external delivery where required using non confidential material.
- Confirm sender details, attachments and junk or quarantine behaviour.
- Keep security protections in place and document any limited exception.
- Record the owner, completion date and support contact for each change.
- Monitor the next scheduled jobs and retire unused accounts after successful testing.
Official sources and further reading
These primary sources were checked when this article was last reviewed.