Microsoft will switch off Basic authentication for SMTP AUTH by default in existing Exchange Online tenants at the end of December 2026. Admins can still turn it back on, tenants created after December 2026 will not have it by default, and Microsoft says it will announce the final removal date in the second half of 2027. Anything that logs in to smtp.office365.com with a username and password is on the affected path; OAuth is the method Microsoft names as supported.
It is easy to read that as the end of SMTP for Outlook inboxes. It is not. The Authenticated SMTP box you ticked to connect them to your sequencer is not what Microsoft is switching off. The password login is. If your inboxes went in through a Microsoft sign-in screen, this change is not aimed at them. If they went in as a list of usernames and passwords, it is.
Microsoft is not switching off the box. It is switching off the password.
Key numbers
| Item | Number |
|---|---|
| Basic auth for SMTP AUTH off by default, existing tenants (admins can still turn it back on) | End of December 2026 |
| New tenants start without it by default | Created after December 2026 |
| Final removal date to be announced | Second half of 2027 |
| Date Microsoft revised the timeline | 27 January 2026 |
| First removal date, announced 15 April 2024 | September 2025 |
| Second plan, first Basic auth rejections | 1 March 2026 |
| Second plan, all Basic auth rejected | 30 April 2026 |
| SMTP AUTH client submission port (smtp.office365.com) | 587 |
| Response once Basic auth is permanently disabled | 550 5.7.30 |
| SMTP AUTH Clients report range, default and longest | 7 and 90 days |
| Smartlead wait after ticking Authenticated SMTP | 20 to 30 minutes |
| HVE accounts per tenant, internal recipients only | Up to 100 |
Read on 13 October 2026: the Exchange Team blog posts of 15 April 2024 and 27 January 2026, Microsoft Learn pages on SMTP AUTH, the SMTP AUTH Clients report and High Volume Email, and Smartlead’s Outlook connection guide.
Microsoft has set three dates. The third flips the default
Microsoft announced the retirement on 15 April 2024, with Basic authentication gone from SMTP AUTH in September 2025. It later moved that to a ramp: a small share of Basic auth submissions rejected from 1 March 2026, all of them by 30 April 2026. On 27 January 2026 it replaced the ramp with the schedule above, saying customers need “sufficient time to adopt viable, secure alternatives.”
The old plans rejected traffic. The new one changes a default. Until the end of December, nothing changes. Then Basic authentication for SMTP AUTH is off in existing tenants unless an admin switches it back on, and a tenant created after December starts without it. Microsoft’s 2024 announcement gives the response once Basic auth is permanently disabled as 550 5.7.30, “Basic authentication is not supported for Client Submission,” and WP Mail SMTP’s troubleshooting guide lists that one beside 535 5.7.139, “basic authentication is disabled.”
Here is the trap. If you planned for April 2026, watched it pass and saw nothing break, the deadline looks soft. It looked soft because Microsoft had already replaced it in January. When I read it on 13 October 2026, WP Mail SMTP’s own guide, updated on 25 May 2026, still said Basic authentication would be completely retired by the end of April 2026. The date that matters now lands at the turn of the year, and a contact form that stops sending does not email you to say so.
The box stays ticked. The password stops working
Microsoft’s documentation says SMTP AUTH, the client submission protocol behind smtp.office365.com, typically on port 587, supports OAuth in addition to Basic authentication. The Authenticated SMTP box in the Microsoft 365 admin center, and the PowerShell setting behind it, turn the protocol on or off for a mailbox. How the login happens is a separate control: Microsoft notes that if an authentication policy disables Basic authentication for SMTP, clients cannot use SMTP AUTH “even if you enable the settings outlined in this article.”
Smartlead’s guide to connecting Outlook shows the split in practice. It connects Outlook mailboxes through OAuth, which is why they cannot be bulk uploaded, and it still tells you to tick Authenticated SMTP and IMAP first and wait 20 to 30 minutes. So the box stays ticked after December. Unticking it would cut off the OAuth inboxes as well, and fix nothing.
smtp.office365.com, port 587, a username and a password typed into a tool.
Basic authentication. Off by default in existing tenants from the end of December 2026.
A Microsoft login screen and a permissions prompt, with Authenticated SMTP ticked.
OAuth, the method Microsoft names as supported for SMTP AUTH.
Who is on the password path
Start with the cold email inboxes. Any Outlook mailbox added through a sequencer’s IMAP and SMTP option with a password, rather than a Microsoft sign-in, sends with Basic authentication. So does a batch of inboxes delivered as a spreadsheet of logins, if it went in the same way.
If you build sending capacity by buying new Microsoft tenants, the rule for new tenants matters as much as the date. For a tenant created after December 2026, Microsoft’s words are that Basic authentication for SMTP AUTH “will be unavailable by default,” and that “OAuth will be the supported authentication method.” A batch bought in January should be planned on the sign-in route from day one. What else a young tenant runs into is in my breakdown of Microsoft 365 sending limits.
Then look past the inboxes. Microsoft lists who uses SMTP AUTH: applications, reporting servers and multifunction devices that send email, plus POP and IMAP clients that need it to send. The one that costs you leads is the website contact form. WP Mail SMTP, a WordPress plugin, tells anyone sending through its Other SMTP mailer with an Outlook username and password to switch to its 365 / Outlook mailer, which needs a paid WP Mail SMTP account. A CRM or booking tool where you typed smtp.office365.com and a password into a custom SMTP screen is in the same position.
Four moves before the end of December
Run the SMTP AUTH Clients report
In the new Exchange admin center, go to Reports, then Mail flow, open SMTP AUTH Clients and widen the range from the default 7 days to 90. The Authentication Protocol column marks each sender Basic Auth (TlsAuthLogin) or Modern Auth (XOAUTH2). Export it to CSV. Every Basic Auth row is on the December list.
Reconnect each password inbox through Microsoft sign-in
Reconnect it through the Microsoft login screen and permissions prompt instead of its password. If your tool can only do that by removing the inbox, check what removal does to its warmup history first. Keep Authenticated SMTP ticked; Smartlead’s guide says to wait 20 to 30 minutes after ticking it. Run the report again a week later and check the row now reads Modern Auth.
Move the form and every app that sends as you
Switch each plugin or app to its OAuth option. If an app can only take a password and only mails your own team, Microsoft’s High Volume Email allows up to 100 HVE accounts per tenant and accepts HVE account credentials or an OAuth token, but it cannot deliver outside your tenant, so the reply to the lead needs another route.
Use the switch back on as a bridge, not a fix
An admin can turn Basic authentication back on after December, but Microsoft will name a final removal date in the second half of 2027, and its 2024 announcement says that once Basic auth is permanently disabled, support cannot re-enable it and there are no exceptions.
The bottom line
Microsoft is retiring the password, not the protocol, and it has not named the final date yet. Find your password senders this week, move them to sign-in, and the December switch finds nothing of yours to turn off. If your cold email runs on Microsoft 365 inboxes and you would rather hand the audit to someone, that is email infrastructure work we take on: every inbox connected through sign-in, in accounts the client owns. I read every Microsoft page cited here on 13 October 2026.