We understand that many customers continue to face real challenges modernizing legacy email workflows and need sufficient time to adopt viable, secure alternatives. Based on customer feedback and visibility into adoption progress, we are refining the Exchange Online SMTP AUTH Basic Authentication Deprecation timeline to provide clearer milestones and additional runway. Now to December 2026: SMTP AUTH Basic Authentication behavior remains unchanged. End of December 2026: SMTP AUTH Basic Authentication will be disabled by default for existing tenants . Administrators will still be able to enable it if needed. New tenants created after December 2026: SMTP AUTH Basic Authentication will be unavailable by default . OAuth will be the supported authentication method.

Second half of 2027: Microsoft will announce the final removal date for SMTP AUTH Basic Authentication. These updates are intended to give customers with tenants in our service (all cloud environments) more time to plan, validate, and deploy modern authentication alternatives, while maintaining a clear path toward stronger default security. Microsoft 365 Messaging Team