SMTP AUTH keeps turning OFF automatically, even though Security Defaults and Legacy Auth Block are OFF

Question

Hello everyone,

I have an issue in my Microsoft 365 tenant:

• Security Defaults = OFF
• Conditional Access “Block Legacy Authentication” = OFF
• All Microsoft‑managed CA policies = OFF
• TransportConfig manually set to SmtpClientAuthenticationDisabled = False
• Authenticated SMTP enabled on the mailbox

But SMTP AUTH keeps turning OFF automatically after some hours, and SmtpClientAuthenticationDisabled flips back to True by itself.

There are no active CA policies, and Security Defaults are disabled.

Has anyone experienced this?

Answer 1

Hi @mYousaf14

Thank you for posting your question in Microsoft Q&A. 

Please note that this is the de-de forum. We kindly recommend posting your question in German so that more community members can assist you. Alternatively, you may post in the English forum if you prefer. We sincerely appreciate your understanding. 

Based on my research, this behavior is a known issue reported by other Microsoft 365 admins, especially in environments where SMTP AUTH is not actively or regularly used. Microsoft has implemented automated security measures that disable SMTP AUTH (by setting SmtpClientAuthenticationDisabled to True) in tenants where no recent usage is detected. This aligns with Microsoft’s broader efforts to phase out legacy authentication protocols for improved security. 

Because of these backend scans, the setting may revert automatically even after you manually enable it via Set-TransportConfig or per-mailbox configuration. If SMTP AUTH isn’t used frequently enough, the system may mark it as unused and switch it back, sometimes within hours or days, as you’ve experienced. 

Temporarily enable it per-mailbox only (using Set-CASMailbox -SmtpClientAuthenticationDisabled $false cmdlet) for specific accounts that require it, while keeping the org-wide setting disabled, as this overrides the global config and may be less prone to flipping if usage is detected on those mailboxes. 

However, keep in mind that Basic Authentication for SMTP AUTH is on a deprecation path. As of early 2026, Microsoft plans to start gradually rejecting Basic Auth submissions starting March 1, 2026, reaching full retirement by April 30, 2026, no exceptions or re-enables will be allowed. After that, you'll need to switch to OAuth (Modern Authentication) for SMTP submissions to continue working. If your apps or devices support it, migrate now using Microsoft's guidance on authenticating via OAuth for SMTP. 

You can refer via: 

Updated Exchange Online SMTP AUTH Basic Authentication Deprecation Timeline | Microsoft Community H… 

Enable or disable SMTP AUTH in Exchange Online | Microsoft Learn 

Please feel free to correct me if I misunderstood your request. If you have any additional concerns, feel free to comment below. I would be more than happy to assist. 

---

Note: Please follow the steps in [our documentation] to enable e-mail notifications if you want to receive the related email notification for this thread.