Find every device still using SMTP AUTH Basic in Microsoft 365

At the end of December 2026, Microsoft turns off Basic auth for SMTP AUTH by default in existing tenants. Anything that logs in to smtp.office365.com with a username and password stops sending. This checklist finds those devices and apps now, while you can still fix them one at a time.

Run this per tenant. If you're an MSP, it's worth doing for every client before the holidays, because the failures will show up as "the scanner stopped emailing" tickets in early January.

Step 1: check the tenant settings

Connect-ExchangeOnline
Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled
Get-CASMailbox -ResultSize Unlimited |
  Where-Object { $_.SmtpClientAuthenticationDisabled -eq $false } |
  Select-Object PrimarySmtpAddress
Get-AuthenticationPolicy | Format-List Name,AllowBasicAuthSmtp

Mailboxes listed by the second command have SMTP AUTH turned on explicitly. They're usually the scanner, alert or app mailboxes you're looking for. A mailbox showing $null follows the tenant setting. If Security Defaults are on, SMTP AUTH is already blocked and anything still trying is already failing.

Step 2: run the SMTP AUTH clients report

In the Exchange admin center, open Reports > Mail flow > SMTP AUTH clients report. It lists the accounts that sent through SMTP AUTH and the authentication protocol they used. Every row using Basic auth is on your list. Export it.

Step 3: check the Entra sign-in logs

In the Microsoft Entra admin center, open Sign-in logs, add the Client app filter and pick Authenticated SMTP. The IP address column tells you which site or office the sign-ins come from, which helps you find the physical device. Failed sign-ins here are devices that are already broken.

Step 4: walk the usual suspects

Reports only show what sent recently. Things that send rarely, like a quarterly report or a UPS alert, can hide. Check these by hand:

Copiers and MFPs (scan to email, fax to email, meter reads to the dealer)
Standalone document scanners
Line-of-business apps, ERP and accounting software that email invoices or statements
NAS, UPS, backup appliances, firewalls and monitoring tools that email alerts
Websites and contact forms using an SMTP plugin with a Microsoft 365 mailbox
Scripts and scheduled tasks using Send-MailMessage or similar

Step 5: pick a fix per device

For each device, write down the model, firmware version and sending mailbox. Then:

Firmware supports Microsoft OAuth 2.0: update it and redo the SMTP setup. Our brand guides link each vendor's support list.
No OAuth firmware, needs to reach external recipients: point it at a relay that signs in with modern auth (ScanRelay is one), or a third-party sender.
Only sends inside the organization: Microsoft HVE or direct send may be enough.
App or script you control: move it to Microsoft Graph or an OAuth-capable library.

The hub guide compares these options and their trade-offs.

Don't plan around re-enabling SMTP AUTH after December. It works for existing tenants for now, but Microsoft will announce a final removal date in the second half of 2027.

Keep older scanners sending, without a third-party mail service

ScanRelay takes plain SMTP from devices on your LAN and sends it as your own mailbox through Microsoft Graph with OAuth. It's open source and self-hostable. The hosted relay and MSP dashboard are in beta.

Join the beta View on GitHub