Exchange Online to Retire Basic Authentication

Exchange Online will permanently remove support for Basic authentication for Client Submission (SMTP AUTH). The change will roll out gradually starting on  the second half of 2027, when a percentage of Basic auth submissions will begin failing.
After this deadline, applications and devices will no longer be able to use Basic authentication and must use OAuth to send email via SMTP AUTH.

Why is this happening?

Basic authentication is an old protocol that transmits usernames and passwords in clear text, making it highly vulnerable to:

• credential theft
• phishing attacks
• brute-force login attempts

To better protect customers and their data, Microsoft is retiring Basic authentication and requiring the use of modern, secure authentication methods such as OAuth.

How will this change be applied?

Microsoft will remove Basic authentication support from the following SMTP AUTH endpoints:

• smtp.office365.com
• smtp-legacy.office365.com

If a device or application attempts to authenticate using Basic auth after it is disabled, the service will return:

• 550 5.7.30 Basic authentication is not supported for Client Submission.

What should I do if I can use OAuth with SMTP AUTH?

You will need to:

1. Register your application in Microsoft Entra
2. Request an OAuth access token
3. Authenticate SMTP requests using that token

Full OAuth SMTP guide (Microsoft Learn):
https://learn.microsoft.com/en-gb/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth

What are the alternatives if I must continue using Basic authentication?

• If you cannot move to OAuth, you must choose one of these alternatives:
• You send mail only inside your Microsoft 365 tenant   ⇒   High Volume Email for Microsoft 365
• You send mail to both internal and external recipients   ⇒   Azure Communication Services Email
• You have an on-premises Exchange Server in hybrid or creating local SMTP relay server that will communicate with Exchange Online over TLS.   ⇒   Use Basic auth against your on-prem server or configure an anonymous relay connector. Create TLS based connector from on premise SMTP server. 

No matter how small or large the email volume is, Basic auth will not remain available in Exchange Online. Your only supported options are HVE, ACS, or an on-premises Exchange hybrid setup.

How to onboard to High Volume Email

High Volume Email (HVE) is a new service built for internal high-volume SMTP submissions and line-of-business applications. It enables reliable bulk internal messaging without needing an on-premises Exchange Server. (Currently in Public Preview.)

Instructions: Manage high volume emails for Microsoft 365 in Exchange Online Public Preview

How to onboard to Azure Communication Services for Email

Azure Communication Services (ACS) provides a centralized platform for outgoing business email, including B2C communication, with insights and full SMTP support for sending.

Instructions: Email SMTP as a service overview in Azure Communication Services

In conclusion

Your path forward is to either:

• update your device/app to support OAuth,
• use a different client that supports OAuth, or
• switch to High Volume Email or Azure Communication Services Email.

Simple summary (for non-IT readers)

• SMTP AUTH Basic login is going away
• Old-style “username + password email login” will stop working
• Some devices and systems may stop sending email, such as printers that send scan-to-email

To prepare, work with your IT team or service provider to:

• Identify all devices and apps that send email
• Check whether they can be updated

! Some outdated products may need replacement, such as:

• Very old printers
• Outlook 2010 or earlier
• Devices or software 10+ years old

If you have any questions or are uncertain about whether this news is relevant to you, please feel free to reach out to us.
 

Contact us