Somewhere in your office a scanner emails PDFs to whoever pressed the button. Your accounting software emails invoices. The ERP sends purchase orders, and a script on the server emails the backup report every night. If your company email is on Microsoft 365, most of these devices log in to smtp.office365.com with a mailbox address and a saved password. That kind of login is called SMTP AUTH with Basic authentication, and Microsoft is switching it off by default at the end of December 2026.
The people who own these machines usually don't read Microsoft's admin notices, so the first anyone hears of it is the accounts team asking why invoices stopped going out. The next few weeks are a good time to find every device and app that sends this way and decide what to do with each one. It takes an afternoon.
What Microsoft is changing, and when
| When | What happens |
|---|---|
| End of December 2026 | Basic authentication for SMTP AUTH is disabled by default in existing Microsoft 365 tenants. An admin can turn it back on. |
| After December 2026 | New tenants start with it unavailable. OAuth is the supported way to sign in. |
| Second half of 2027 | Microsoft says it will announce the date Basic authentication for SMTP AUTH is removed for good. |
So this is not a cliff yet. If something stops sending in January, your admin can switch it back on and buy time. But the final removal date is coming, and switching it back on isn't a fix. It's a reminder to fix it later.
This is separate from the EWS switch-off on 1 October, which hits backup tools and CRM connectors. The SMTP change hits things that send mail.
What usually breaks
- Scanners and multifunction printers with scan-to-email. Most can't do OAuth at all, especially models more than a few years old.
- Accounting and ERP software that emails invoices, statements and POs from a saved mailbox password. Newer releases often support OAuth; TallyPrime, for example, now offers Microsoft sign-in for email. Older installs that were set up years ago with a password are the ones at risk.
- Scripts and scheduled jobs: PowerShell
Send-MailMessage, Python or PHP scripts, cron jobs, backup and monitoring alerts. - Website contact forms and small web apps that send through a Microsoft 365 mailbox.
- CCTV recorders, NAS boxes, UPS and biometric attendance machines that email alerts.
When it breaks, the device usually shows a vague "authentication failed" or "cannot send" error. Nobody connects it to a Microsoft change made weeks earlier.
Find everything that sends this way
- In the Exchange admin center, open Reports, Mail flow, SMTP Auth clients. It lists the mailboxes that sent over SMTP AUTH and whether they used Basic authentication.
- Check the Microsoft Entra sign-in logs for those mailboxes to see where the logins come from (IP addresses tell you which office or server).
- Walk the office. Ask accounts, admin and IT which machines "send emails by themselves". Write each one down with its model, software version and the mailbox it uses.
Once you have the list, each item gets one of four answers.
Your four options, device by device
| Option | Good for | Watch out for |
|---|---|---|
| 1. Switch it to OAuth | Software that supports it: newer ERP and accounting releases, updated apps and scripts | Needs an app registration in Microsoft Entra and someone to set it up. Most scanners can't do it. |
| 2. Use a Microsoft 365 SMTP relay | Several devices behind one office connection with a fixed public IP | Needs a static IP and a connector configured in Exchange Online. Doesn't help branch offices on ordinary broadband. |
| 3. Turn Basic authentication back on | Buying time in January | Temporary. It stops working on the removal date Microsoft announces in 2027. |
| 4. Send device mail through a separate mailbox that accepts a username and password | Old scanners, recorders, legacy software, anything that can only do a password | Your domain's SPF and DKIM must cover the second service, or better, use a subdomain such as alerts.yourcompany.in. |
For most small offices the honest answer is a mix. Update what can be updated to OAuth, and move the machines that never will be onto option 4.
Option 4 in practice
You keep Microsoft 365 for your people. You create one or two mailboxes elsewhere, only for machines, for example scanner@alerts.yourcompany.in, and point the devices there with a username and password over TLS. Mail they send is signed for the subdomain, so it doesn't affect the reputation of the domain your staff send from.
XgenPlus mailboxes accept authenticated SMTP over TLS from any device or application, and an XGEN Starter mailbox is ₹21 a month, billed annually. Two device mailboxes come to about ₹500 a year plus GST. Add SPF, DKIM and DMARC records for the subdomain so the mail lands in the inbox and not in spam; our support team will check the records with you. If you're curious how sending from apps works more generally, we wrote about SMTP or API for app email.
If you'd rather leave Microsoft 365 altogether, that's a bigger decision and our pricing is public, but you don't need to make it to fix your scanners.
A one-page plan for December
- This month: run the SMTP Auth clients report and make the device list.
- October: check each item's manual or vendor site for OAuth support. Update what can be updated.
- November: move everything else to a relay or a separate device mailbox. Test by sending to an outside address, such as a personal Gmail.
- December: in a quiet week, turn Basic authentication off yourself before Microsoft does, so any surprises happen on your schedule.
Tell us which devices you have and we'll tell you which option fits each one. Send us your list and we reply within one business day.
Sources: Microsoft Exchange Team blog, "Updated Exchange Online SMTP AUTH Basic Authentication Deprecation Timeline" and "Exchange Online to retire Basic auth for Client Submission (SMTP AUTH)"; Tally Solutions, "OAuth-Based Email Integrations in TallyPrime" (effective 14 May 2026). Checked 23 September 2026. Microsoft can change dates; confirm against the Message Center for your tenant.
