End of Basic Auth SMTP on Microsoft Exchange Online: timeline, 550 5.7.30 error, and migration guide

Since 2019, Microsoft has been gradually eliminating Basic authentication (username + password) from its Exchange Online protocols. EAS, POP, IMAP, EWS, PowerShell: all were migrated to Modern Auth by the end of 2022. The last holdout was SMTP AUTH Client Submission, the protocol used by multifunction printers, sending scripts, and line-of-business applications to submit emails through smtp.office365.com on port 587.

In April 2024, Microsoft announced the end of this last holdout. After several postponements (September 2025, then March 2026), the revised January 2026 timeline grants additional time, but the message is clear: Basic Auth SMTP is on its way out, and every organization needs to plan its migration.

This article covers the exact timeline, affected systems, the five available alternatives, and a hands-on migration checklist.

What is Basic Auth SMTP and why is it a problem?

Basic authentication for SMTP works simply: the client encodes the username and password in Base64 and transmits them to the server in the AUTH LOGIN or AUTH PLAIN command. Even when the connection is encrypted with TLS (STARTTLS on port 587), the credentials are reusable, never expire, and lack a second factor.

C: AUTH LOGIN
S: 334 VXNlcm5hbWU6
C: dXNlckBjYXB0YWluZG5zLmNvbQ==
S: 334 UGFzc3dvcmQ6
C: bW90ZGVwYXNzZQ==
S: 235 2.7.0 Authentication successful

This mechanism creates three major risks:

OAuth 2.0 addresses all three issues: tokens are temporary (60 min by default), revocable, scoped to a specific permission (SMTP.Send), and compatible with MFA and conditional access.

SMTP AUTH Client Submission vs SMTP Relay

It's important to distinguish between two sending mechanisms in Exchange Online:

The Basic Auth retirement only affects Client Submission. IP-based SMTP relays (option 2 in Microsoft's documentation) are not affected.

Complete retirement timeline

The timeline has been revised several times. Here is the consolidated schedule as of February 19, 2026:

The 550 5.7.30 error

After the disablement, any client attempting Basic authentication will receive:

550 5.7.30 Basic authentication is not supported for Client Submission.

This error is a permanent rejection (5xx code). The sending server will not retry. Emails are not queued: they are lost immediately.

Who is affected?

Any application or device sending emails through smtp.office365.com or smtp-legacy.office365.com with a username and password is affected.

Typically affected systems

How to identify Basic Auth senders

Microsoft updated the SMTP AUTH report in the Exchange Admin Center (EAC) in October 2024 to distinguish Basic Auth connections from OAuth connections.

1. Sign in to admin.exchange.microsoft.com
2. Go to Reports > Mail flow > SMTP Auth Clients report
3. Filter by authentication type to isolate Basic Auth senders

Each row shows the sender address, message count, and authentication type used.

Alternative 1: OAuth 2.0 for SMTP AUTH

This is Microsoft's recommended solution for clients and applications that can handle OAuth tokens.

Prerequisites

1. Register an application in Microsoft Entra (Azure AD)
2. Add the SMTP.Send permission (interactive flow) or SMTP.SendAsApp (application flow)
3. Obtain admin consent for the tenant

Two possible flows

SMTP session with OAuth

The client uses the SASL XOAUTH2 mechanism:

C: AUTH XOAUTH2 dXNlcj1hbGVydHNAY2FwdGFpbmRucy5jb20BYXV0aD1CZWFyZXIgZXl
KMGVYQUlPaUpLVjFRaUxDSmhiR2NpT2lKU1V6STFOaUo5Li4uAQE=
S: 235 2.7.0 Authentication successful

The Base64 token encodes user=alerts@captaindns.com followed by the OAuth Bearer token. The token expires after 60 minutes; the client must handle renewal via the refresh token.

Limitations

• Multifunction printers (MFP) and IoT devices generally do not support OAuth
• Requires an application registration in Entra ID
• The Client Credentials flow requires registering a Service Principal in Exchange Online via PowerShell

Alternative 2: High Volume Email (HVE)

The HVE service is designed for high-volume internal sending from applications and devices.

When to use HVE

HVE is suitable when:

• The device does not support OAuth (MFP, IoT)
• Emails are exclusively internal (alerts, notifications, scan-to-email to tenant mailboxes)
• Volume is high (no rate limit on recipients)

Creating an HVE account

Via the EAC: Mail flow > High Volume Email (Preview) > Add HVE account.

Or via PowerShell:

New-MailUser -HVEAccount -Name "Scanner Alerts" -PrimarySmtpAddress "scanner-alerts@captaindns.com"

Warning: HVE is in public preview. Microsoft reserves the right to suspend the service. Do not assign licenses to HVE accounts.

Alternative 3: Azure Communication Services Email

Azure Communication Services (ACS) Email enables both internal and external sending via a REST API or SDKs (.NET, Python, JavaScript, Java).

ACS is relevant for cloud-native applications that can integrate an SDK. It is not suitable for physical devices (printers, scanners) that only speak SMTP.

Alternative 4: on-premises SMTP relay

For organizations in a hybrid configuration (Exchange Online + on-premises Exchange Server), a local SMTP relay remains an option.

How it works

1. Devices (MFP, IoT, scripts) send to the local Exchange server via port 25 (anonymous relay)
2. The Receive connector is configured to accept connections from an internal IP range
3. The local Exchange server relays to Exchange Online via the Send connector

Receive connector configuration

New-ReceiveConnector -Name "Anonymous Relay" `
  -TransportRole FrontendTransport `
  -Usage Custom `
  -Bindings 0.0.0.0:25 `
  -RemoteIPRanges 192.168.1.0/24 `
  -PermissionGroups AnonymousUsers

Pros and cons

Alternative 5: Microsoft Graph API

For scripts and applications, the Graph API offers the /users/{id}/sendMail endpoint as a superior replacement for SMTP.

curl -X POST "https://graph.microsoft.com/v1.0/users/alerts@captaindns.com/sendMail" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "message": {
      "subject": "Alerte monitoring",
      "body": {"contentType": "Text", "content": "Le serveur DNS est indisponible."},
      "toRecipients": [{"emailAddress": {"address": "ops@captaindns.com"}}]
    }
  }'

Graph API is ideal for replacing PowerShell scripts (Send-MailMessage is deprecated) and server applications. It is not suitable for hardware devices that can only execute SMTP.

Alternatives comparison table

Migration checklist

Impact on deliverability and security

The Basic Auth retirement does not affect SPF, DKIM, or DMARC. These email authentication protocols operate at the DNS level and remain independent of the SMTP authentication method.

However, the migration provides an opportunity to strengthen your security posture:

• MFA everywhere: OAuth enables enforcing multi-factor authentication on interactive sending accounts
• Revocable tokens: unlike a compromised password that remains valid until changed, an OAuth token expires automatically
• Conditional access: you can restrict SMTP sending to specific IP ranges, compliant devices, or time windows
• Granular auditing: OAuth connections are traceable in Entra ID logs with details on the application and scope used

This move by Microsoft is part of a broader trend. Google and Yahoo imposed stricter authentication requirements for bulk senders starting in 2024. Securing the SMTP sending channel is the logical next step.

Glossary

• Basic Auth: authentication method that transmits the username and password encoded in Base64. No inherent protection against replay attacks.
• OAuth 2.0: authorization protocol based on temporary tokens. Supports MFA and conditional access.
• SASL XOAUTH2: SASL mechanism used to transmit an OAuth 2.0 token within an SMTP, IMAP, or POP session.
• Client Submission: authenticated SMTP sending method via smtp.office365.com (port 587). The sender authenticates with credentials.
• SMTP Relay: IP-based SMTP sending method without credentials. Uses an Exchange Online inbound connector.
• HVE (High Volume Email): Microsoft 365 service enabling high-volume internal sending via smtp-hve.office365.com. Public preview.
• Microsoft Entra: the new name for Azure Active Directory. Manages application registrations, permissions, and OAuth tokens.
• Service Principal: application identity in Exchange Online, required for the OAuth Client Credentials flow.
• MFA: multi-factor authentication. Not possible with Basic Auth, native with OAuth 2.0.

Sources

• Exchange Online to retire Basic auth for Client Submission (SMTP AUTH) - Exchange Team Blog, April 2024
• Updated Exchange Online SMTP AUTH Basic Authentication Deprecation Timeline - Exchange Team Blog, January 2026
• Deprecation of Basic authentication in Exchange Online - Microsoft Learn
• Authenticate an IMAP, POP or SMTP connection using OAuth - Microsoft Learn
• Manage High Volume Email for Microsoft 365 - Microsoft Learn