Mailbox Settings guidance

Question

Hi All,

I have a requirement to disable SMTP Authentication (SMTP AUTH) and would like to understand the potential impact.

We are running an Exchange Server (SE) hybrid environment, where user mailboxes are created on-premises and then migrated to Exchange Online.

Current configuration:

• Applications are using both on-premises and Exchange Online relays:
  • On-prem relay: smtp.mydomain.com (ports 25/587)
  • Exchange Online relay: smtp.office365.com (port 587)
  At the tenant level (Exchange Admin Center → Settings → Mail Flow), SMTP AUTH is disabled (screenshot attached). At the mailbox level (Users → Active Users → Email Apps → Manage Email Apps), Authenticated SMTP is enabled (screenshot attached).

My questions:

If I disable SMTP AUTH at the mailbox level, what will be the impact on:

1. End-user email flow
2. On-premises relay scenarios
3. Will this impact services such as printers, applications, or other devices that rely on SMTP authentication?
4. Exchange Online relay (smtp.office365.com)
5. Since SMTP AUTH is already disabled at the tenant level, is it still necessary to disable it at the mailbox level as well?

What is the recommended approach to safely disable SMTP AUTH in a hybrid environment like this?

Any guidance or best practices would be greatly appreciated

Tenant Level Setting

Mailbox level setting

Answer 1

Hi @Glenn Maxwell 

Thank you for posting your question in the Microsoft Q&A forum. 

Based on your setup, here is the expected impact and recommended approach for disabling SMTP AUTH in a hybrid environment. 

Impact of disabling SMTP AUTH at the mailbox level  

End-user email flow  

There will be no impact to end users. Clients such as Outlook, Outlook on the web, and mobile apps use Modern Authentication (OAuth), not SMTP AUTH.  

On-premises relay scenarios  

• If your applications and devices are relaying through your on-premises Exchange server (for example, via smtp.mydomain.com on port 25 without authentication), there will be no impact.  
• If a system authenticates using SMTP AUTH to Exchange Online (for example, smtp.office365.com on port 587 using mailbox credentials), that scenario will stop working once SMTP AUTH is disabled for that mailbox. 
• SMTP AUTH settings in Exchange Online apply only to mailboxes hosted in Exchange Online and do not affect SMTP authentication against on‑premises Exchange servers. 

Devices and applications  

These will be impacted only if they authenticate to smtp.office365.com:587 using a mailbox username and password. Those send attempts will fail once SMTP AUTH is disabled for that mailbox. 

Exchange Online relay (smtp.office365.com:587)  

This method requires SMTP AUTH. Disabling it at the mailbox level breaks this functionality. 

Tenant-level vs mailbox-level setting 

Even though SMTP AUTH is disabled at the tenant level, mailbox-level settings can override this.  

If SMTP AUTH remains enabled on individual mailboxes, it can still be used. Therefore, to fully disable SMTP AUTH, it is recommended to also disable it at the mailbox level, except for any explicitly required exceptions.  

Recommended approach: 

• Identify any accounts using SMTP AUTH (Azure AD / Entra sign‑in logs, Client App = SMTP). 
• Migrate printers and applications to connector‑based relay (port 25) or OAuth‑based sending. 
• Disable SMTP AUTH tenant‑wide. 
• Remove mailbox‑level exceptions once dependencies are addressed. 

This approach allows you to safely disable SMTP AUTH in a hybrid environment without affecting users or mail flow, while improving security. 

Reference: Enable or disable SMTP AUTH in Exchange Online | Microsoft Learn 

I hope this information is helpful. 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".          

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.   

Answer 2

Impact is entirely on clients and devices that submit mail using authenticated SMTP (SMTP AUTH) to Exchange Online; normal end‑user mail flow in Outlook/OWA and hybrid mail routing are unaffected.

Key behaviors to keep in mind

1. Two independent controls exist:
   • Tenant level: Set-TransportConfig -SmtpClientAuthenticationDisabled $true|$false or Turn off SMTP AUTH protocol for your organization in the EAC.
   • Mailbox level: Set-CASMailbox -SmtpClientAuthenticationDisabled $true|$false|$null or Authenticated SMTP in Manage email apps.
   The mailbox setting overrides the tenant setting. $true = disabled, $false = enabled, $null = follow tenant setting.
2. What happens if SMTP AUTH is disabled
   • For a mailbox where SMTP AUTH is disabled (either globally or per mailbox), any client or device that tries to send via smtp.office365.com on port 587 using that mailbox’s credentials will fail to authenticate.
   • POP/IMAP clients that rely on SMTP AUTH for sending will no longer be able to send mail, even though they can still receive.
   • Applications, printers, and other devices that use that mailbox and SMTP AUTH to submit mail to Exchange Online will stop sending successfully.
   • Modern Outlook, Outlook on the web, and typical MAPI/EWS/ActiveSync clients do not use SMTP AUTH, so interactive end‑user mail flow is not impacted.

Answers to the specific questions

1. Impact on end‑user email flow
   • None for standard Outlook/OWA/mobile clients, because they do not use SMTP AUTH.
   • Only users who have configured POP/IMAP plus SMTP AUTH, or who use that mailbox for app/device SMTP submission, will be impacted.
2. Impact on on‑premises relay
   • If on‑premises relay to smtp.mydomain.com uses an on‑premises SMTP server without authenticating to Exchange Online with SMTP AUTH, it is unaffected.
   • If any on‑premises application or relay uses smtp.office365.com with mailbox credentials (client SMTP submission), those flows will fail when SMTP AUTH is disabled for that mailbox or tenant.
3. Impact on Exchange Online relay (smtp.office365.com)
   • smtp.office365.com on port 587 is the client SMTP submission endpoint and requires SMTP AUTH. Disabling SMTP AUTH (tenant or mailbox) breaks this scenario for the affected mailboxes.
4. With SMTP AUTH already disabled at tenant level, is mailbox‑level disable still needed?
   • If SmtpClientAuthenticationDisabled is True at tenant level, SMTP AUTH is disabled for all mailboxes except those where the mailbox property is explicitly set to $false (enabled).
   • In that case, clearing or disabling Authenticated SMTP at the mailbox level is only needed if there are mailboxes that were explicitly allowed ($false) and should now be brought back under the global disabled state.
5. Will this impact printers, applications, or devices?
   • Yes, for any printer/app/device that:
     • Uses smtp.office365.com on port 587, and
     • Authenticates with a mailbox whose SMTP AUTH is disabled (by tenant or mailbox setting).
   • Devices that relay anonymously through an on‑premises SMTP server or another method that does not use SMTP AUTH to Exchange Online are not affected.
6. Recommended approach in a hybrid environment
   1. Inventory current SMTP AUTH usage
      • Identify which devices/apps use smtp.office365.com with credentials.
      • Use the mailbox‑level reports described in the docs to see where SMTP AUTH is enabled:
        • Get-CASMailbox -ResultSize unlimited | where {$_.SmtpClientAuthenticationDisabled -eq $false} to list mailboxes explicitly enabled.
   2. Disable SMTP AUTH globally, then selectively re‑enable only where required
      • Tenant level: Set-TransportConfig -SmtpClientAuthenticationDisabled $true or enable Turn off SMTP AUTH protocol for your organization.
      • For the few mailboxes that must still use SMTP AUTH (for legacy devices/apps that cannot be changed yet), explicitly enable it:
        • Set-CASMailbox -Identity <mailbox> -SmtpClientAuthenticationDisabled $false.
   3. Where possible, migrate away from SMTP AUTH
      • Prefer alternatives recommended for apps/devices:
        • High Volume Email for Microsoft 365 for internal‑only scenarios.
        • Azure Communication Services Email for internal and external recipients.
        • Or use an on‑premises SMTP server for basic auth/anonymous relay instead of SMTP AUTH in Exchange Online.
   4. Validate
      • After changes, test each known app/device path to confirm mail submission still works or is intentionally blocked.
      • Use Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled and Get-CASMailbox -Identity <MailboxIdentity> | Format-List SmtpClientAuthenticationDisabled to verify effective settings.

This pattern (tenant disabled, selectively enabled per mailbox only where absolutely necessary) aligns with the documented security best practice to keep SMTP AUTH disabled wherever possible.

---

References:

• Enable or disable authenticated client SMTP submission (SMTP AUTH) in Exchange Online
• How to set up a multifunction device or application to send email using Microsoft 365 or Office 365
• Best practices for configuring the Built-in security add-on for on-premises mailboxes
• Can't connect to Outlook by using POP/IMAP and Modern authentication