SMTP Basic Auth deprecation in Microsoft 365

Updated: July 2026

Microsoft is retiring basic authentication (username plus password) for SMTP client submission in Exchange Online. In plain terms, an application that today sends through smtp.office365.com with a username and a password will stop working. This page explains what changes, who is affected, and how to keep sending without recoding anything.

What changes, and when

Microsoft's announced timeline for SMTP AUTH is:

• Since 30 April 2026: Microsoft has begun rejecting basic authentication for SMTP client submission. Applications and devices must use OAuth (modern authentication) to keep using SMTP AUTH.
• End of December 2026: basic authentication for SMTP AUTH is disabled by default on existing tenants.
• After December 2026: new tenants have no basic authentication for SMTP at all; only OAuth is available.

In other words, if your sending still relies on an SMTP password, the window is already open and closes by the end of the year.

Who is affected

Anything that sends mail through Office 365 with a classic SMTP credential: printers and copiers doing scan-to-email, ERP and CRM systems (Business Central, Sage, Odoo and others) sending invoices and notifications, monitoring and alerting tools, in-house line-of-business software, scripts. These systems often have no easy path to OAuth: no up-to-date library, no support for the authorization flow, sometimes frozen firmware.

The native options, and their limits

Move each application to OAuth 2.0. This is the path Microsoft recommends, but it means changing every application or device, which is impossible for a copier or an unmaintained third-party tool.

High Volume Email (HVE). Microsoft's bulk-send mechanism is now geared to internal use and subject to its own limits; it does not drop a copy on the sender side.

Direct Send. Sending without authentication to your own domain, but no copy in Sent Items, more fragile deliverability, and continued hardening on Microsoft's side.

The fluctuat approach: keep SMTP, no recoding

fluctuat is an SMTP relay that speaks modern authentication to Microsoft 365 on your behalf. Your applications keep speaking SMTP exactly as today: you simply replace the outgoing server with your dedicated fluctuat endpoint, using a credential created in the console. No library to install, no OAuth to wire into each application, no PowerShell.

Behind the scenes, the message goes out through the Microsoft Graph API, within your own Microsoft 365 tenant, as the real sender, with a copy dropped in their Sent Items. The permission granted is Mail.Send only, and the fluctuat application is a Microsoft verified publisher. An SMTP credential can be restricted to your servers' IP addresses.

The result: the end of Basic Auth no longer breaks your sending, and you have rewritten nothing.

Create an account, first send in ~15 min

Free to start, no card. A Sovereign edition is available for sending that never transits through Dizzus.

Frequently asked

Do we have to change our applications? No. They speak SMTP as today; you change only the outgoing server and the credential.

Does it work for a copier doing scan-to-email? Yes, as long as it can point at an SMTP server and present a credential.

Where do the messages go? Through your own Microsoft 365, never through a third-party sending domain to delegate in SPF or DKIM.