Turning SMTP AUTH back on for a copier

What Microsoft has said

Microsoft has announced that SMTP AUTH with basic authentication is disabled by default for existing Microsoft 365 organizations at the end of December 2026, that admins can turn it back on, and that it will announce the final removal date in the second half of 2027. Organizations created after December 2026 won't have it at all. Microsoft has moved these dates before, so check its current announcement.

The settings involved

SMTP AUTH has long had two switches, and both have to allow it:

• For the organization: in the Exchange admin center (Settings, Mail flow), or with Set-TransportConfig -SmtpClientAuthenticationDisabled $false in Exchange Online PowerShell.
• For the mailbox the copier uses: in the Microsoft 365 admin center, open the user, Mail, Manage email apps, and tick Authenticated SMTP; or Set-CASMailbox -Identity scanner@yourdomain.com -SmtpClientAuthenticationDisabled $false.

Two more things commonly block it even when both are on: security defaults in Microsoft Entra (they block basic authentication outright), and Conditional Access policies that block legacy authentication. Microsoft may also add a separate switch for the post-December change; if these don't do it, look for that in its documentation.

Why it's only a stopgap

• It ends when Microsoft removes basic authentication for good, and you'll be back where you started, likely with less notice.
• The copier's mailbox can sign in with just a password, no MFA. That's the kind of sign-in attackers try first, and turning off security defaults to allow it weakens the whole organization.
• Cyber insurance questionnaires and security reviews increasingly ask whether legacy authentication is off.

If you do turn it back on, limit it to the one mailbox the copier uses, give that mailbox a long unique password, and plan the permanent change while the copier still works.

The permanent options

OAuth firmware on the copier, a connector, Direct Send, scanning to a folder, or a local relay. Compared here. Scan Relay, which I make, lets you leave basic authentication off: the copier sends to an office PC on port 25 with no sign-in, and Scan Relay sends to Microsoft 365 through Microsoft Graph with OAuth. Free for 14 days, then $99 once per office.

Not sure your copier even uses SMTP AUTH? answer three quick questions.