Will Your Scanner Stop Emailing? The Microsoft 365 SMTP AUTH Change

If your office printer scans to email, or your business software sends automatic emails through Microsoft 365, a change at the end of December 2026 could quietly stop it working. Microsoft is turning off basic authentication for SMTP AUTH by default. This guide explains what that means in plain English, how to check whether you’re affected, and what to sort out before the Christmas break.

Last updated 13 November 2026. Microsoft has moved these dates before, so we’ll update this page if anything changes.

What is changing

Lots of devices and apps can create an email but can’t send it on their own. The most common way they send through Microsoft 365 is called SMTP AUTH (Microsoft also calls it client SMTP submission). The device connects to smtp.office365.com on port 587 and signs in with the username and password of a Microsoft 365 mailbox.

Signing in with just a username and password is known as basic authentication. Microsoft’s reason for switching it off is security: a password on its own is an easy target for credential theft, phishing and password-guessing attacks. The replacement is modern authentication (OAuth), where the device uses a secure token instead of storing and sending a password.

This only affects devices and apps sending email this particular way. Staff using Outlook on their PC or phone, or Outlook on the web, aren’t affected.

The timeline

• Now to December 2026: nothing changes. Basic authentication for SMTP AUTH keeps working as it does today.
• End of December 2026: Microsoft turns basic authentication for SMTP AUTH off by default for existing organisations. An administrator can turn it back on for now.
• New organisations created after December 2026: basic authentication for SMTP AUTH won’t be available by default.
• Second half of 2027: Microsoft will announce the final removal date. After that, turning it back on won’t be an option.

Microsoft first planned to start rejecting basic authentication in March 2026 and finish by the end of April 2026, then put that on hold. We wouldn’t count on another delay.

What could stop working

Anything that sends email through a Microsoft 365 mailbox using a saved username and password. In a typical small business, that’s things like:

• Multifunction printers and scanners that scan documents straight to email.
• Business software that emails invoices, statements, reminders or reports, such as accounting, practice management or booking systems.
• Website contact forms that send through a Microsoft 365 mailbox.
• Alarm panels, backup devices, UPS units and server monitoring that email alerts.
• Older scripts that send automated emails.

The tricky part is that nothing obviously breaks. The device shows a sign-in error that nobody looks at, and the scanned document, invoice or alert simply never arrives. Often nobody notices until someone goes looking for it.

How to check if you’re affected

1. Run the SMTP AUTH report. In the Exchange admin centre, go to Reports, then Mail flow, and open the SMTP AUTH clients report. It shows which accounts send using SMTP AUTH, and it has a column showing whether each one uses basic authentication or OAuth.
2. Check your devices. Look in the email or scan to email settings on your printers and other devices. If you see smtp.office365.com with a username and password, that device is affected.
3. Ask your software vendors. Ask whether their product supports Microsoft 365 modern authentication (OAuth) for sending email, and how to switch it on.

Your options to fix it

There’s no single fix for everything. The right option depends on the device, your internet connection and who the emails go to.

• Switch to modern sign-in (OAuth). The best option where it’s available. Many newer printers and apps support it, sometimes after a firmware or software update.
• SMTP relay through a connector. The device sends to your domain’s Microsoft 365 mail address on port 25, and Microsoft trusts it because of a connector set up for your static public IP address or a certificate. It can send to people inside and outside your business and doesn’t need a mailbox licence. You need a static IP address that isn’t shared with anyone else.
• Direct send. The device sends straight to Microsoft 365 without signing in, but it can only email people inside your own organisation. Microsoft says most customers don’t need it, so we treat it as a last resort.
• High Volume Email for Microsoft 365. A Microsoft service for sending lots of email, but only to people inside your organisation.
• A dedicated sending service. Azure Communication Services Email or a third-party email sending service suits websites and cloud software that email customers.
• Replace the device. Microsoft requires TLS 1.2 or later for SMTP AUTH. If an old device only offers port 465, or supports neither OAuth nor TLS 1.2, it may be time to replace it.

What to do before December

1. List everything that sends email. Printers, software, website forms, alarms, backups and anything else that emails you automatically.
2. Check the report to catch anything you missed.
3. Move each one to OAuth or another sending method, starting with the ones you’d miss most.
4. Test each one once it’s moved. You don’t want to find out over Christmas, when the office is quiet and nobody notices the missing emails.
5. Don’t rely on switching it back on. It’s a temporary stopgap, it keeps the security risk, and it ends when Microsoft sets the final removal date.

Questions we get asked

Will our normal email stop working?

No. Outlook on your PCs and phones, and Outlook on the web, already use modern sign-in. This change only affects devices and apps that send email with a saved username and password.

Can’t we just turn basic authentication back on?

For a while, yes. An administrator can turn it back on after December 2026, but only until the final removal date that Microsoft will announce in the second half of 2027. It’s a stopgap, not a fix.

Our printer is old and has no OAuth option. What now?

Check for a firmware update first. If there isn’t one, an SMTP relay connector usually works if you have a static IP address. If the printer can’t use TLS 1.2 either, replacing it is often the cheapest long-term answer.

Does this affect our website?

It does if your website sends its emails through a Microsoft 365 mailbox using a username and password. Most good WordPress email plugins can connect to Microsoft 365 with modern sign-in instead, or you can switch to a dedicated sending service.

Related reading

• Email Security
• Microsoft 365 Consulting
• Verify Your SPF, DKIM and DMARC Records
• How to Set Up MFA for Your Organisation’s Microsoft 365

Sources: Microsoft 365 Message Center MC786329 (updated 27 January 2026); Microsoft Exchange Team blog; Microsoft Learn: send email from a multifunction device or application; Microsoft Learn: authenticate an SMTP connection using OAuth; Office 365 for IT Pros.