Microsoft 365 SMTP AUTH Basic Auth Cut-off: What Breaks for Cold Emailers

At the end of December 2026, Microsoft turns off Basic auth for SMTP AUTH by default in Exchange Online. Any cold email inbox that sends through smtp.office365.com with a username and password stops sending unless you reconnect it with OAuth. Inboxes already connected through Microsoft's sign-in screen keep working. Fix it in December, not on the first Monday of January.

This post is for people who send cold email from Microsoft 365 inboxes through a sequencer such as Instantly, Smartlead, lemlist or a custom script. The Microsoft 365 SMTP AUTH cut-off checker shows which of your sending domains are on Microsoft 365, so you know which inboxes to look at first.

What Microsoft is changing

SMTP AUTH client submission is the login an app uses to send mail through smtp.office365.com on port 587. Until now it accepted a plain username and password. That is "Basic auth".

Microsoft has tried to retire it before. The timeline that applies now comes from the Exchange team's 27 January 2026 update:

Date	What happens
Until December 2026	No change. Basic auth for SMTP AUTH still works where it is enabled.
End of December 2026	Basic auth for SMTP AUTH disabled by default for existing tenants. Admins can turn it back on.
Second half of 2027	Microsoft says it will announce the final removal date.

That update replaced an earlier plan to finish removal by 30 April 2026, which Microsoft put on hold. Dates like this have moved more than once, so read the Microsoft Learn page on Basic auth deprecation before you plan around them.

What breaks and what does not

Connection	Affected?
Inbox connected in your sequencer through "Sign in with Microsoft" (OAuth)	No
Inbox connected with an app password over SMTP	Yes
Inbox connected with a username and password over SMTP	Yes
A CRM, website form or invoicing tool that sends through a Microsoft 365 mailbox with a password	Yes
Scripts using smtplib, Nodemailer or similar with a password	Yes
Mail sent from Outlook desktop, web or mobile apps	No, they use modern auth
Receiving mail	No

The trap for cold emailers is the bulk connection. Many teams added dozens of Microsoft inboxes to a sequencer with a CSV of usernames and app passwords because it was faster than clicking through OAuth for each one. Those are exactly the inboxes that stop.

How to tell if you are affected

1. List every Microsoft 365 inbox you send from. Paste your sending domains into the SMTP AUTH cut-off checker. It reads MX records and tells you which domains are on Microsoft 365. DNS cannot tell you how each inbox logs in, so that is the next step.
2. Check the connection type in your sequencer. Most tools show whether an account was added through OAuth or SMTP/IMAP. If you see SMTP host smtp.office365.com and a password field, it is Basic auth.
3. Check other senders. Anything else that sends as those mailboxes: a CRM, a booking tool, a support desk, a scanner. These often get forgotten until a customer says they never got an invoice.
4. Ask your inbox reseller. If you bought pre-warmed Microsoft inboxes, ask how they were connected and whether they will reconnect them by OAuth.

The fix, in order

1. Reconnect each inbox by OAuth. In your sequencer, remove the SMTP connection and add the inbox again with the Microsoft sign-in. Follow your sequencer's own guide; the steps differ and change. Microsoft documents the OAuth method for apps in How to authenticate an IMAP, POP or SMTP application by using OAuth.
2. Check tenant consent. Some tenants block users from granting app access. If the OAuth screen asks for admin approval, the tenant admin has to approve the sequencer's app once.
3. Keep warmup history. Reconnecting usually keeps the inbox's warmup and sending history in your tool, but confirm with your sequencer before deleting anything.
4. Send one test from each inbox. A small test to an inbox you control confirms the new connection works. Do this in December while there is time to fix stragglers.
5. Update scripts and other tools. For custom code, switch to OAuth tokens. For third-party apps that cannot do OAuth, Microsoft suggests other routes such as a relay connector or a dedicated sending service.

Turning Basic auth back on at the tenant level is possible for now, but it only buys time. Microsoft has said a final removal date is coming, so treat re-enabling as a short bridge, not a plan.

A second Microsoft change for new tenants

If you set up new Microsoft 365 tenants for new sending domains, a separate change affects you. Microsoft is rolling out a new calculation for the Tenant External Recipient Rate Limit, which gives tenants under 31 days old 10% of the standard external recipient quota, 25% between 31 and 60 days, and trial tenants 500 external recipients a day. Over the limit, mail to outside recipients is blocked with 550 5.7.233. The details are in Microsoft's Exchange Online limits page.

For cold email, that means a brand-new tenant cannot carry much volume in its first two months, whatever its inbox count.

Do not let the gap age your list

The auth change does not touch your lead list. But a common pattern goes like this: inboxes stop sending in early January, it takes two weeks to find out why and reconnect them, and the campaign resumes on a list that was built in November.

B2B data decays as people change jobs. A list that was clean when you built it picks up invalid addresses month by month, and the first batch after a long pause is where bounce rates spike. If your campaigns stalled, re-check the leads before resuming. Our guide to how B2B contact data decays covers the rates, and you can verify a list here with 100 free checks when you sign in with Google.

Quick checklist

• Paste sending domains into the cut-off checker.
• List every inbox connected by SMTP with a password.
• Reconnect each one by OAuth in your sequencer.
• Get admin consent if the tenant requires it.
• Send a test from each inbox.
• Update CRMs, forms and scripts that send as those mailboxes.
• Re-verify leads if sending was paused for more than a few weeks.

Keep January sending smooth

Fixing authentication gets your inboxes sending again. Keeping bounces low is the other half. Verify every lead list before it goes into a campaign, and keep catch-all and risky leads in their own campaign. Plans for regular list cleaning are on the pricing page.