136 days until Microsoft 365 disables SMTP AUTH Basic auth

[github-actions[bot]]

Microsoft disables Basic authentication for SMTP AUTH by default on
existing Microsoft 365 tenants at the end of December 2026 —
136 days from today. Administrators can still re-enable it after
that; the final removal date is announced in the second half of 2027.

Source: Microsoft's updated timeline.

If you have not checked yet

Find-SmtpAuthExposure.ps1
reports every mailbox in your tenant that can still authenticate this way.
It is read-only, so it is safe to run before you have decided anything.

It counts the mailboxes that inherit the tenant setting separately,
which the widely-repeated -eq $false one-liner misses entirely — on a
tenant nobody has locked down, that one-liner can report zero while every
mailbox is exposed.

Then check whether your hardware has a way out

• Compatibility list — what each vendor has published, with a link to every statement
• Models the vendor has ruled out — where firmware is not a step you skipped, it does not exist
• What the error messages mean

If a firmware update exists for your model, apply it. That keeps your
own domain as the sender and involves no third party. The
migration guide
covers every option in order, including Direct Send, which is free and is
often the right answer when every recipient is inside your own tenant.

This project's relay is the last resort on that list, for devices that
have no other path. There are 20 ready-to-run examples if it turns out to
be yours.

---

Posted automatically at deadline milestones (90, 60, 30, 14, 7 and 1 days).
Replies are read — if you have migrated, what worked for your setup helps
whoever reads this next.