Exchange Online SMTP AUTH retirement timeline: use the revised milestones

Define the decision

Older articles cite superseded March or April 2026 cutoff dates. The January 2026 revision says behavior remains unchanged through December 2026, with default-disable changes at the end of December; Microsoft plans to announce the final removal date in the second half of 2027.

Work through the procedure

1. Inventory applications still using SMTP usernames and passwords.
2. Identify owners and distinguish Basic authentication from OAuth-based SMTP.
3. Validate a supported modern-authentication path before changing production credentials.
4. Recheck Microsoft’s live announcement at each migration milestone.

Worked example

The following is a synthetic example for this procedure, not a customer result or performance benchmark.

Inventory row: invoice sender, Basic SMTP, finance owner
Migration evidence: OAuth test submitted and controlled reply received
Planning note: H2 2027 is an announcement milestone, not a claimed final shutdown date

Read the result

The extra runway is a planning opportunity, not a reason to leave an untested dependency indefinitely. A tenant can already disable Basic authentication through its own policy before a service-wide deadline.

Check before moving on

1. Confirm the actual authentication method used by each application.
2. Keep the announcement URL and review date in the migration record.

Limits and next action

This timeline was reviewed on September 16, 2026 and can change. Consult the linked Microsoft announcement for tenant-specific transition details before scheduling a cutover.

Source: Microsoft: revised SMTP AUTH Basic authentication timeline