Updated
Microsoft switched basic auth off. Are you done?
Not quite. In Exchange Online, basic authentication for Exchange ActiveSync, POP, IMAP, EWS, Remote PowerShell, the offline address book, Autodiscover and Outlook was switched off from 1 October 2022, and it cannot be switched back on.
Authenticated SMTP (SMTP AUTH) is the exception, because printers, scanners and line-of-business applications use it to send mail. Under Microsoft's current timeline, updated in January 2026, basic auth for SMTP AUTH will be disabled by default for existing tenants at the end of December 2026, admins can still re-enable it, and Microsoft will announce the final removal date in the second half of 2027. Check Microsoft's Exchange blog before you plan around these dates.
Blocking legacy authentication in Entra ID as well means a stolen password cannot be tried through these protocols at all, whatever Exchange still allows.
How to find what still uses it
- In the Entra admin center, go to Entra ID > Monitoring & health > Sign-in logs.
- Choose Add filters > Client app and select the legacy clients: Exchange ActiveSync, IMAP, POP, Authenticated SMTP and the other legacy clients listed under 'Legacy authentication clients'.
- Set the date range to the last 30 days and check both the 'User sign-ins (interactive)' and 'User sign-ins (non-interactive)' tabs.
- List the accounts and applications that appear. Successful sign-ins are the dependencies you must move first; failed ones are usually attacks.
In Exchange Online PowerShell you can see whether SMTP AUTH is off for the organisation and which mailboxes have an exception:
Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled
Get-CASMailbox -ResultSize Unlimited |
Where-Object { $_.SmtpClientAuthenticationDisabled -eq $false } |
Select-Object PrimarySmtpAddressHow to block it without breaking the printer
- Move each dependency you found: a multifunction printer or application can send through an SMTP relay with a connector in Exchange Online, or use OAuth. Modern versions of Outlook and mobile mail apps already use modern authentication.
- Switch SMTP AUTH off for the organisation with Set-TransportConfig -SmtpClientAuthenticationDisabled $true, and leave a per-mailbox exception only where a device truly cannot be moved yet.
- In Entra ID > Conditional Access, create a policy from the template 'Block legacy authentication'. It targets the client apps 'Exchange ActiveSync clients' and 'Other clients' and grants Block access. Add your break-glass accounts as an exclusion.
- Leave the policy in Report-only for a week, check the sign-in logs for anything it would have blocked, then switch it to On.
On tenants without Entra ID P1, security defaults block legacy authentication too.
Frequently asked
Microsoft disabled basic authentication in 2022. Why block it again?
The 2022 change covered most Exchange Online protocols, but not SMTP AUTH, which Microsoft will only disable by default from the end of 2026. A Conditional Access block also stops legacy sign-ins at the identity layer, so a stolen password cannot be tested through them.
Will blocking legacy authentication break my scanner?
It will if the scanner sends mail with SMTP AUTH and a username and password. Find these devices in the sign-in logs first and move them to an SMTP relay connector or OAuth before you switch the block on.
Do I need Entra ID P1?
For a Conditional Access policy, yes. Security defaults also block legacy authentication and are free, but they cannot be combined with Conditional Access policies of your own.