Blog Post

Exchange Team Blog
1 MIN READ

Updated Exchange Online SMTP AUTH Basic Authentication Deprecation Timeline

The_Exchange_Team's avatar
The_Exchange_Team
Platinum Contributor
Jan 27, 2026

We understand that many customers continue to face real challenges modernizing legacy email workflows and need sufficient time to adopt viable, secure alternatives. Based on customer feedback and visibility into adoption progress, we are refining the Exchange Online SMTP AUTH Basic Authentication Deprecation timeline to provide clearer milestones and additional runway.

  • Now to December 2026: SMTP AUTH Basic Authentication behavior remains unchanged.
  • End of December 2026: SMTP AUTH Basic Authentication will be disabled by default for existing tenants. Administrators will still be able to enable it if needed.
  • New tenants created after December 2026: SMTP AUTH Basic Authentication will be unavailable by default. OAuth will be the supported authentication method.
  • Second half of 2027: Microsoft will announce the final removal date for SMTP AUTH Basic Authentication.

These updates are intended to give customers with tenants in our service (all cloud environments) more time to plan, validate, and deploy modern authentication alternatives, while maintaining a clear path toward stronger default security.

Microsoft 365 Messaging Team

Updated Jan 29, 2026
Version 3.0
administration
announcements
exchange online
Planning and Architecture
protocols
security
setup
transport

7 Comments

  • ColeRutherford's avatar
    ColeRutherford
    Occasional Reader
    Jan 30, 2026

    Maybe now you guys can tighten up the Tech doc for Azure Comm Service setup, and also add some decent documentation on using OAuth 2.0 in Business Central.

  • Matt-Dunn's avatar
    Matt-Dunn
    Copper Contributor
    Jan 28, 2026

    New tenants created after December 2026: SMTP AUTH Basic Authentication will be unavailable by default. OAuth will be the supported authentication method.

    To clarify, whilst SMTP Basic Authentication will be unavailable by default, will it be possible to enable for new tenants  after December 2026? (Before its removed for all customers at a later time)

  • meetmitul's avatar
    meetmitul
    Copper Contributor
    Jan 28, 2026

    This is a good news. For a large companies relying on exchange online using SMTP, this will be a huge change as each and every system is impacted which sends an email. Missing a few will cause a big interruptions. I would recommend those working on this changes to continue with it and get over it while at it.

    • Jarrod_miller's avatar
      Jarrod_miller
      Occasional Reader
      Jan 30, 2026

      Basic authentication is very 2005. A few missed emails is worth not being compromised by password guessing.  These same companies who rely on smtp with basic authentication also do not rotate creds, ever...

  • Dave Stork's avatar
    Dave Stork
    MVP
    Jan 28, 2026

    I'm working with some customers who will be glad that this deadline has been delayed, there's a lot of legacy cleanup going on with Exchange (Server) related to al sorts of things. Giving more time will help those orgs deal with all of those changes in a more relaxed way. Yes, some things should've been fixed months or years back, but every experienced IT specialist knows how it goes. 

    The only "irritation" I have is that this is the third time something got changed by the Exchange Team HOURS before an important meeting on breaking changes deadlines. COME ON! 😁

  • tk3's avatar
    tk3
    Copper Contributor
    Jan 27, 2026

    For tenants created after December 2026, is it still possible to enable SMTP AUTH Basic Authentication?

  • tijsbouwmans's avatar
    tijsbouwmans
    Copper Contributor
    Jan 27, 2026

    Great, as this sometimes can be challenging due to third party legacy email workflows.

    The updated timeline gives more time to prepare, also with vendors.

    This is now much clearer and it changes the timeline significantly compared to the one communicated before.

    Thanks for another update on this.