In 2019, Microsoft began a multi-step effort to disable Basic Auth in Exchange Online, for which it sent reminders to organizations on a regular basis. This effort wrapped up in late 2022, with the only exception being Client Submission (SMTP AUTH). Although Microsoft had planned to deprecate this authentication mechanism in the protocol within a few months from now, it has delayed this process by several more months.
While the Redmond tech firm had previously announced that it would begin phasing out Basic Auth in SMTP AUTH after March 1, 2026, with full disablement scheduled for April 30, 2026. Apparently, IT admins, and by extension, organizations, are not ready for this change, which is why Microsoft is pushing back the date of deprecation further.
Under the new timeline, Basic Auth in the protocol will continue to work as-is from now to December 2026. Following the end of the year, it will be disabled by default for all existing tenants, but IT admins will have the option to re-enable it. Meanwhile, any new tenants configuring Exchange Online after December 2026 will not be able to utilize this option at all, with the only supported authentication method being OAuth, which is a form of Modern Authentication. In the second half of 2027, Microsoft will reveal the final deprecation date for Basic Auth in SMTP AUTH.
Microsoft says that this timeline is due to the fact that organizations are facing challenges in modernizing legacy email workflows with more secure alternatives. Redmond hopes that this delay in deprecation will allow its customers more time to plan, test, and validate these changes. That said, it"s interesting that Microsoft is still reluctant to announce a final date for deprecation, and looking at its track record, it would be no surprise if there are further delays in this process.