Basic Authentication Deprecation in Exchange Online – Time’s Up

You gave people enough time as awareness for this change. No more delay, let it happen 😈. Damned if you do dammed if you don’t.

System.Net.Mail.SmtpClient is deprecated, Legacy Applications don't support modern authentication, MailKit doesn't support confidential client authentication; what more solutions do we have to send an email?

This isn't about letting people know. People are using legacy apps that might not be getting many updates. I paid for a product that had this and then someone just decided to take it. I didn't actually find out about it because my IT department was you know gutted by Covid and I don't read MS press releases. If you don't want it for your account go for it, but don't force it on me because you think oauth is so great. I don't really think oauth 2.0 is a huge improvement and setting it up is cumbersome to say the least. I'd rather seen IP whitelisting and other real security vs trying to fix everything with ever more complicated keys. So you have the key and you are in Russia you can still get in? What the heck are we all smoking.

We are going to workaround this with a proxy etc, but honestly I just wish there where real alternatives to Exchange in that corporate America would consider, because this is what monoplistic behavior looks like.

MichaGarza - we don't use Authentication Policies (what the UI shows) to block basic. 

We're going to do some work to gray out those checkboxes or completely remove them in the coming months. They do nothing (with the exception of the one for SMTP) once basic is blocked at the service level in your tenant. 

This will make enabling multi-factor authentication a lot easier by forcing all sign-ins using modern auth and MFA in turn will make phishing attempts less effective.

This Web App helped as quickly find all devices still on basic authentication, it will give you a quick idea if you still have users on basic auth and how many (might be helpful).

Thanks to Microsoft for making email a lot more secure

Hi everyone, 

Just had one query we are using office 365 for email functionalities and using smpt , IMAP and POP3 in our application and scripts what will be the timeline for disabling basic auth as I see recent dates it's something around 1 March 2023 . Is there option to avoid this disablement of basic auth for impacted protocol till migration with modern authentication techniques ? 

So reading between the lines, there will be 7 days grace ... so shutdown will be from 7 January not 1 January? I inherited a system I am in the process of moving to use OAuth2 ... do I have 7 more days or not (at least, depending on when we are going to be notified?). And I agree with Eric Twilegar ... not everyone had 3 years ... sanctimonious comments from some ppl is not helping.

Hifni Nazeer - we're not disabling basic for SMTP AUTH just yet, you can keep using basic for the time being. 

Mahesh15 - time is up. We will be disabling basic for POP and IMAP (and more) in January. 

madmax786 - somewhat correct - you'll get a 7-day warning. So if you haven't had one yet, you still have (at least) 7 days. 

Microsoft will put a banner on top of your main Admin page.  This happened to our account a few months ago which scared me because the ticketing server at the time can only use basic auth.  We only use three mailboxes just for the ticketing server with basic auth.  All of my users are using modern auth so honestly don't know why Microsoft couldn't make an exception for those with basic auth to secure it with conditional access like trusted IPs? 

From what I've been reading lately Microsoft will start notifying rest of the office 365 admins pretty soon.  Probably middle of this month.

When we select your tenant we will both post a message to Message Center, and we'll post to the Service Health Dashboard too, both giving you 7 days (approx) warning. Tenants are being selected every day currently. We're not doing it all in one go, my friends in support wouldn't appreciate that.