This is going to be awful for us. We deal with a lot of very small businesses that have less than 10 users, but use SMTP AUTH for a multi-function device. None of them use Azure and one of the solutions here is to force them to sign up to Azure and have and account with consumption based billing where the stakes for a compromised account are way, way higher than a compromised email account.
We need a simple solution like fine grained SMTP AUTH using an app password for a single account with configurable rate limits.
This is shifting a huge burden of complexity onto the customer and it's too much for the small businesses we deal with. Now we'll have to tell them that MS365, which is expensive for them, won't work with their multi-function devices.
The auth management in MS365 has gotten so complicated over the years that it's almost impossible for us to deal with. There's so much complexity that we're always looking for instructions on how to make something work and no one has a decent understanding of all the permissions that are assigned. It's susceptible to mistakes because it's too complex.
Microsoft seems unable to understand that not every tenant has a full time MS365 admin. The service is becoming unusable for small customers due to the complexity and this change is a perfect example of that.