The scanner in the hallway may stop emailing in December

Somewhere in your office there is a device that sends email with a username and a password typed into a settings page years ago. It might be the scanner that mails PDFs to whoever is standing at it. It might be the accounting system that sends invoices at two in the morning, or a monitoring tool that tells you when the server room gets warm. These all use a protocol called SMTP AUTH, and most of them use the oldest and weakest way of proving who they are.

Microsoft has been trying to close that door for a long time. The date has moved more than once. The current plan was published in January 2026 and it is specific.

What changes, and when

Until the end of December 2026 nothing changes. At that point basic authentication for SMTP AUTH is switched off by default in existing tenants. Administrators will still be able to switch it back on if they need to. Tenants created after December 2026 will not have it available by default at all. Then, in the second half of 2027, Microsoft says it will announce the date on which it goes away for good.

So this December is not the cliff. It is the warning shot, and it is a useful one, because a default that flips is the best audit you will ever get. Whatever stops working on the first Monday of January was depending on the old method.

Why not just turn it back on?

You can, and for a few weeks you may have to. But basic authentication sends a reusable password with every message, and a mailbox that accepts it is a mailbox that can be attacked with nothing more than a guessed or leaked password. Turning the setting back on for the whole organization to keep one copier alive is a poor trade.

What to do this month

The Exchange admin center has a report that shows which clients submit mail over SMTP AUTH and whether they use basic or modern sign in. Start there. It will show you accounts you had forgotten. For each one, find the device or program behind it and put it in one of three piles.

• It supports modern sign in. Update the firmware or the software and reconfigure it.
• It never will. Plan to replace it, or send its mail through a relay or a service built for application mail.
• Nobody knows what it is. Disable the account for a day and see who calls.

The third pile is always larger than people expect.

Where X-Axis fits

We include this audit in Microsoft 365 moves and security reviews for clients across the United States and Canada. If you would rather hand over the list, our Microsoft 365 page explains how we work.