Websites, ERP and business apps after Microsoft 365 SMTP Basic auth is off
Copiers get the attention, but plenty of business software also sends mail by logging in to smtp.office365.com:587 with a mailbox username and password: website contact forms, accounting and ERP systems sending invoices, practice-management and CRM tools, and in-house code. That login is Basic auth. Microsoft disables it by default in existing tenants at the end of December 2026. Here's how to find these senders and what to move each one to.
What actually changes
Only the password login to SMTP AUTH goes away. SMTP AUTH itself stays, and apps that sign in with OAuth 2.0 (XOAUTH2) keep working. So for each app, the question is: can it sign in to Microsoft with OAuth, or does it only take a username and password?
App passwords don't help. An app password is still Basic auth and stops at the same time.
Find them
Exchange admin center ▸ Reports ▸ Mail flow ▸ SMTP AUTH clients, filtered on Basic authentication, and the Entra sign-in logs with Client app = Authenticated SMTP. Business apps often send only at month-end (statements, invoices, payroll), so look back at least 30 days, ideally across a month-end. The sending mailbox usually tells you which app it is. Full checklist: Find devices and scripts still using SMTP AUTH Basic.
App by app
| Sender | What to check | What to do |
|---|---|---|
| Websites (WordPress SMTP plugins, contact forms, shop order emails) | The plugin's mailer setting. "Other SMTP" pointed at smtp.office365.com with a password is Basic auth. | Switch to the plugin's Microsoft 365 / Outlook mailer, which signs in through an app registration, if your plugin or plan has one. Otherwise send through a transactional email service and set SPF/DKIM for the domain. |
| Accounting, ERP, practice-management and CRM software (on-premises or self-hosted) | Email or SMTP settings. Look for "Microsoft 365", "Modern authentication" or "OAuth" as an option. | Update to a version with Microsoft OAuth and re-add the account that way. If the vendor has no OAuth option, ask for their date in writing. If they can't give one before December, plan a relay (below). |
| Cloud SaaS that emails "from" your domain | Does it log in to your mailbox, or send through its own servers? | If it sends through its own servers (you added SPF/DKIM records for it), it isn't affected. If it asked for your Microsoft 365 password, it is. |
| In-house code (.NET, PHP, Python, Java, PowerShell) | Search for smtp.office365.com and stored mailbox passwords. | Move to Microsoft Graph sendMail, or keep SMTP and use XOAUTH2 with the client-credentials flow. Both need an app registration; scope it to the sending mailbox only. Scripts: see Send-MailMessage and scripts. |
Options for apps you can't change
- Local SMTP relay that sends through Microsoft Graph. Point the app at a relay on your network (limited to the app server's IP, optionally with a local password). The relay sends through Graph with an app registration that may send only as that mailbox. Mail stays in your tenant, lands in Sent Items, and there are no DNS changes. ScanRelay is a free, open-source relay built for this.
- Microsoft 365 SMTP relay connector. Needs a static public IP, and Microsoft is tightening unauthenticated sending (see Reject Direct Send).
- A transactional email service (SMTP2GO, SendGrid, Mailgun). Works with anything, but mail leaves your tenant, won't show in Sent Items, and needs SPF/DKIM changes.
Before December
- Make a list: app, sending mailbox, owner, method chosen, date tested.
- Test with a real document (an invoice or statement), not just the app's "test email" button, since attachments and large messages fail differently.
- Re-check after month-end. The apps you missed show up then.
Running this across many client sites? The ScanRelay MSP beta is building a hosted relay and a multi-tenant dashboard with per-sender logs and alerts before an app secret expires.
Related: NAS and UPS alerts · 550 5.7.30 explained · MSP cutover checklist