Exchange Online to retire Basic auth for Client Submission (SMTP AUTH)

Question

We need your guidance regarding Microsoft’s upcoming retirement of Basic Authentication for SMTP AUTH on March 1, 2026.

Our application currently sends email using the configuration shown below (SMTP over port 25 with no authentication). Since the app does not support OAuth/Modern Auth, our only alternative would be to use an SMTP relay that handles modern authentication with Microsoft on our behalf.

Could you please clarify the following:

1. Will the retirement of SMTP Basic Auth impact SMTP relays as well, or only direct authenticated SMTP connections?
2. Does Microsoft plan to restrict Direct Send (port 25, unauthenticated) after March 1, 2026?
3. Are there relay options (Microsoft or third-party) that can perform OAuth on behalf of legacy applications?
4. Which relay methods will continue to function reliably after the cutoff date?

We want to ensure our current setup or a supported relay architecture will continue working beyond March 1, 2026

 

Answer 1

Hi @Amulya Talari

Thank you for posting your question in Microsoft Q&A. 

We understand that you are seeking guidance regarding Microsoft’s upcoming retirement of Basic Authentication for SMTP AUTH . 

For your concerns: 

Impact of SMTP Basic Auth Retirement 

Based on my research, the retirement of Basic Authentication applies only to Client Submission (SMTP AUTH), the authenticated method used for sending emails via ports 443 or 587 to endpoints such as smtp.office365.com. After this change, any direct connection from your application to Microsoft using Basic Auth will fail. 

SMTP Relay is a separate mechanism. It uses an inbound connector and authenticates via network/IP filtering, not per-message Basic Auth. Therefore, if you’re using SMTP Relay without Basic Auth (for example, via a connector and static IP), your setup remains unaffected. 

Plans to Restrict Direct Send 

Direct Send, which uses the MX endpoint on port 25 without authentication, is not affected by the SMTP AUTH Basic Authentication deprecation. As of now, I have not found any official Microsoft announcement indicating plans to retire or restrict this mechanism yet. 

For Relay Options That Perform OAuth on Behalf of Legacy Applications 

You could consider: 

1.High Volume Email: Currently in preview, with General Availability targeted for March 2026. It supports OAuth 2.0 and will continue to allow Basic Authentication for HVE only until September 2028. This solution is designed for internal workloads. 

You can refer via: High Volume Email: Continued support for Basic Authentication & other important updates | Micro… 

2.Azure Communication Services: An alternative email-sending API that fully supports modern authentication. 

Relay Methods That Will Continue to Function Reliably After the Cutoff Date 

Only Client SMTP AUTH using Basic Authentication will be retired after the cutoff date.

Other relay methods will remain supported, including: Client SMTP AUTH with Modern Authentication (OAuth 2.0), SMTP Relay via Connector, Direct Send (unauthenticated), High-Volume Email Solutions, Azure Communication Services Email.

Please feel free to correct me if I misunderstood your request. If you have any additional concerns, feel free to comment below. I would be more than happy to assist.  

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".      

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. 

Answer 2

1. The retirement of Basic Authentication for SMTP AUTH will primarily impact direct authenticated SMTP connections. However, it is important to note that if your SMTP relay uses Basic Authentication, it will also be affected. Therefore, transitioning to a relay that supports Modern Authentication is advisable.
2. Microsoft has not explicitly stated plans to restrict Direct Send (port 25, unauthenticated) after March 1, 2026. However, relying on unauthenticated methods may pose security risks, and it's recommended to consider using authenticated methods instead.
3. There are relay options available, both from Microsoft and third-party providers, that can perform OAuth on behalf of legacy applications. These relays can help bridge the gap for applications that do not support Modern Authentication.
4. Relay methods that will continue to function reliably after the cutoff date are those that utilize Modern Authentication (OAuth). It's essential to ensure that any relay you choose is updated to support these authentication methods to maintain functionality beyond the retirement date of Basic Authentication.

To ensure your current setup or a supported relay architecture continues working beyond March 1, 2026, it is advisable to start planning for the transition to Modern Authentication as soon as possible.