Basic Authentication for SMTP Deprecation

Question

Hello,

I understand that basic authentication is being discontinued later this year. Is Microsoft planning on creating temporary blocks as a way to remind users to prepare for the discontinuation? I believe they did this years ago for the TLS 1.1 discontinuation.

Thanks.

Answer 1

Hi @Anon4343
Thank you for posting your query on Microsoft Q&A.

I understand that basic authentication is being discontinued later this year. Yes, Microsoft planning on creating temporary blocks as a way to remind users to prepare for the discontinuation.

In mid-October 2024, we will update the SMTP AUTH Clients Submission Report in the Exchange admin center to show if Basic auth or OAuth is being used to submit email to Exchange Online. In January 2025, we will send a Message Center post to tenants who are using Basic auth with Client Submission (SMTP AUTH) to alert them to the upcoming change. In August 2025, about 30 days before we disable Basic auth we will send another Message Center post to tenants who are still using Basic auth with Client Submission (SMTP AUTH).

Although SMTP AUTH is available now, we announced Exchange Online will permanently remove support for Basic authentication with Client Submission (SMTP AUTH) in September 2025. We strongly encourage customers to move away from using Basic authentication with SMTP AUTH as soon as possible. For more Information about alternative options, please see our announcement here- https://techcommunity.microsoft.com/t5/exchange-team-blog/exchange-online-to-retire-basic-auth-for-client-submission-smtp/ba-p/4114750. Other options for sending authenticated mail include using alternative protocols, such as the Microsoft Graph API.
Follow the document for more information: https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online

Hope this helps. Do let us know if you have any further queries.

If this answers your query, do click `Accept Answer` and `Yes`.

Answer 2

Hello Bandela, I am currently looking at the exchange admin center>reports>mail flow>smtp auth clients report and I think there must be something wrong with it.

I have a list of senders addresses in the report and some of them say they are using Basic Authentication, but when I click on any one of the sender addresses, it opens a side window and says that the sender is using modern authentication. Am I missing something here? Is there a good way to report on sender addresses that are still potentially using basic auth for client submission?

Thank you