Synology, QNAP and UPS email alerts after Microsoft 365 SMTP Basic auth is off

NAS boxes, UPS network cards, firewalls and backup appliances usually send their alerts by logging in to smtp.office365.com:587 with a mailbox username and password. That login is Basic auth. Microsoft disables it by default in existing tenants at the end of December 2026. When that happens, the "disk failing", "on battery" and "backup failed" emails stop, and nothing on the device tells you. Here's how to check each device and what to switch it to.

Why these devices are the risky ones

A copier that can't scan gets reported the same morning. A NAS that can't send its alert fails silently. The first sign is usually a degraded RAID or a dead UPS battery that nobody was warned about. Treat alerting devices as the top of your cutover list, not the bottom.

Find them first: Exchange admin center ▸ Reports ▸ Mail flow ▸ SMTP AUTH clients (filter on Basic authentication), and the Entra sign-in logs with Client app = Authenticated SMTP. Alert mailboxes send rarely, so look back at least 30 days. Full checklist: Find devices and scripts still using SMTP AUTH Basic.

App passwords don't help. An app password is still Basic auth, so it stops working at the same time. If a device's only Microsoft option is "username + password" or "app password", plan to move it.

Device by device

Device	Where to look	What to do
QNAP NAS (QTS / QuTS hero)	Notification Center ▸ Service Account and Device Pairing ▸ Email	If the account was added as Custom with `smtp.office365.com`, it uses Basic auth. Delete it and add it again with the Outlook.com provider, which signs in through Microsoft and gets a token. Expect an occasional "Authorization has expired" warning that needs a re-authorize click.
Synology NAS (DSM)	Control Panel ▸ Notification ▸ Email	Check how the Microsoft account was set up. If DSM is asking for a mailbox password or app password, or the provider is Custom SMTP pointed at `smtp.office365.com`, that's Basic auth. Update DSM and use a provider option that signs in through Microsoft if your version has one; otherwise use a relay (below).
UPS network cards (APC NMC, Eaton, CyberPower and similar)	Web UI ▸ Notification / Email / SMTP	Most cards only offer server, port, username and password. Plan on a relay or an internal-only option for these. Don't wait for a firmware update.
Firewalls, switches, hypervisors, IPMI/iDRAC/iLO	Alerting / SMTP settings	Same rule: if the only option is a username and password against `smtp.office365.com`, it breaks. Many can also send syslog or SNMP traps to your monitoring tool. If you already have one, that's a fine alternative.
Backup appliances and software	Job notification settings	Newer versions of many backup products offer Microsoft 365 OAuth or Graph sign-in. Update first, then re-add the account with that option.

Options for devices with no OAuth

Local SMTP relay that sends through Microsoft Graph. Point the device at a small relay on your LAN (no auth, or a local password, limited to the device's IP). The relay sends through Graph with an app registration that may send only as the alert mailbox. Mail stays in your tenant and shows up in Sent Items, and you don't need DNS changes. ScanRelay is a free, open-source relay built for this.
Microsoft 365 direct send or an SMTP relay connector. This works for alerts that go only to your own domain. Microsoft is tightening direct send and some tenants block it entirely (see Reject Direct Send). A connector needs a static public IP.
High Volume Email (HVE). Internal recipients only, so it's fine for alerts to your own team but not for an MSP's ticketing address on another domain.
A third-party SMTP service (SMTP2GO, SendGrid, Mailgun). This works with any device, but mail leaves your tenant and needs SPF/DKIM changes for the sending domain.

Test it before December

After you switch a device, trigger its test email and check it arrives. Then check the Sent Items of the alert mailbox if you use a Graph relay.
Pull a real alert where you can: unplug the UPS from the wall for a few seconds, or pull a hot-spare drive on a lab NAS.
Write the method next to each device in your documentation, so the next person doesn't put a password back in.

Running this across many client sites? The ScanRelay MSP beta is building a hosted relay and a multi-tenant dashboard with per-device send logs and alerts before an app secret expires.

Join the MSP beta View on GitHub

Synology, QNAP and UPS email alerts after Microsoft 365 SMTP Basic auth is off

Why these devices are the risky ones

Device by device

Options for devices with no OAuth

Test it before December

Sources