Microsoft SMTP AUTH Changes: Fix Your Email Now

Who the Microsoft SMTP AUTH Change Affects

You’re affected if an app, plugin, or device signs in to Microsoft’s SMTP server (smtp.office365.com or smtp-mail.outlook.com) with your email address and password. Common examples include:

• Website contact forms and WordPress notifications
• Apps that send order confirmations, password resets, or alerts
• Printers and scanners that use scan-to-email
• Scripts, backup tools, and accounting software that email reports

When Microsoft turns off Basic authentication, the app’s emails stop sending. Its error log usually shows a message like this:

535 5.7.139 Authentication unsuccessful, basic authentication is disabled.

Which date applies depends on the type of account you sign in with:

• Personal accounts (Outlook.com, Hotmail.com, Live.com): Basic authentication stopped working on September 16, 2024. If you see the error above with a personal account, the change has already happened.
• Microsoft 365 work or school accounts: Basic authentication keeps working until the end of December 2026. After that, it’s off by default.

If your app already signs in with OAuth 2.0 (the “Sign in with Microsoft” window), you don’t need to change anything.

Automating Microsoft 365 email with flows? Our guide shows how to send email in Power Automate through an SMTP provider.

How to Check Which Apps Still Use a Password

If you manage a Microsoft 365 organization, you can see every app and device that still sends with Basic authentication. Microsoft calls this the SMTP AUTH clients report.

To open it, sign in to the Exchange admin center and go to Reports » Mail flow. Then click SMTP AUTH clients report.

The report lists each sender address, how many messages it sent, and whether it signed in with Basic auth or Modern auth (OAuth). By default, it shows the last 7 days. If it’s empty, pick a longer date range.

Write down every sender that uses Basic auth. Those are the apps and devices you’ll need to move before the deadline.

Microsoft SMTP AUTH Deprecation Timeline

Microsoft published an updated timeline for Microsoft 365 (Exchange Online) on January 27, 2026. Here’s what it says:

A tenant is your organization’s Microsoft 365 account. Microsoft’s deprecation page points to the Exchange team’s announcement for the current dates.

Turning Basic auth back on only buys time. Once Microsoft sets the final removal date, the switch goes away for good.

How to Fix Microsoft SMTP Authentication Errors

To fix Microsoft SMTP AUTH errors, your app has to stop signing in with a password. You can switch it to OAuth 2.0, send through the Microsoft Graph API, or move your emails to a transactional email service like SendLayer. Here’s how each option works.

What you’ll need:

• Access to the email settings of the app, plugin, or device that sends your emails
• For OAuth or the Graph API: your Microsoft 365 account, plus an admin who can approve app access if your organization requires it
• For the WordPress shortcut: an Easy WP SMTP Pro license
• For SendLayer: access to your domain’s DNS settings, where you’ll add a few records

1. Update to Modern Authentication

If you want to keep sending through your Microsoft account, your app needs to sign in with Modern authentication (OAuth 2.0) instead of a password.

First, check whether your app or plugin supports OAuth for Microsoft. Look for a “Sign in with Microsoft” button in its email settings.

Some apps list it as XOAUTH2. If you don’t see it, check for an update or ask the developer.

Without a ready-made button, you’ll register your own app in Microsoft Entra ID (formerly Azure Active Directory). Then you copy its ID and secret into your app.

Microsoft explains the steps in its guide to authenticating an SMTP connection with OAuth.

For WordPress sites, there’s a shortcut. Easy WP SMTP Pro has a 365 / Outlook mailer with a One-Click Setup option. You sign in with your Microsoft account, and you don’t have to create your own app in Microsoft’s portal.

To set it up:

1. In your WordPress dashboard, go to Easy WP SMTP » Settings.
2. Under Mailer, choose 365 / Outlook.
3. Turn on One-Click Setup and click Save Settings.
4. Click Sign in with Microsoft, sign in to your account, and approve access.
5. Go to Easy WP SMTP » Tools » Email Test and send a test email.

One-Click Setup needs an active Easy WP SMTP Pro license. The mailer then sends through the Microsoft Graph API instead of SMTP, so the SMTP AUTH change doesn’t affect it. For details, see Easy WP SMTP’s Outlook mailer guide.

2. Send Through the Microsoft Graph API

Microsoft names its Graph API as another way to send authenticated email. Graph is Microsoft’s web API for Microsoft 365, and its sendMail request sends email over HTTPS instead of SMTP.

This option suits developers who write their own code. It still needs an app registration and OAuth tokens, so it’s not a quick fix for a printer or a plugin. Microsoft’s sendMail reference has the request format.

3. Switch to a Dedicated Transactional Email Service

Many teams use this change to move their website and app emails to a dedicated transactional email service. That’s a service built to send automated emails, like receipts and password resets, rather than person-to-person mail.

This is often the fastest fix for devices and plugins without OAuth support. You keep using SMTP and only change 4 settings: the host, port, username, and password.

Here’s how to switch an app or device to SendLayer:

1. Create a SendLayer account.
2. Authorize your sending domain. In your SendLayer dashboard, click Add Domain, enter your domain, and add the 5 DNS records it shows you. DNS changes can take 24 to 48 hours to take effect. Our guide to authorizing your domain walks through each record.

3. Go to Settings » SMTP Credentials and copy your SMTP username and password.

4. In your app or device’s email settings, replace the Microsoft details with these:
   • SMTP host: smtp.sendlayer.net
   • Port: 587
   • Encryption: TLS (also called STARTTLS)
   • Username and password: the SMTP credentials you just copied
5. Set the From address to an email on your authorized domain, like notifications@yourdomain.com.
6. Save the settings and send a test email.

You also get analytics and tracking for every email, so you can see what was delivered and what bounced.

SendLayer offers a free account option for the first 200 emails you send. That’s an easy way to see if it’s a good fit for your needs.

Troubleshooting Microsoft SMTP AUTH Errors

If emails still don’t send after you’ve made the switch, check these common causes.

You still see 535 5.7.139 after setting up OAuth. The app may still be using its old password settings. Open its email settings, make sure the Microsoft sign-in you set up is the saved option, then send a new test email.

A work account fails before December 2026. Your admin may have turned off SMTP AUTH for your organization or for your mailbox. Ask them to check the setting in the Exchange admin center.

Your SendLayer test fails with a 535 error. Check that you copied the SMTP password from Settings » SMTP Credentials, not your account login. SendLayer’s guide to the 535 authentication error walks through the other causes. You can also test your SMTP connection before you change your app.

SendLayer won’t send from your address. Make sure your domain shows as authorized in your SendLayer dashboard and that your From address uses that domain. New DNS records can take 24 to 48 hours to take effect.

The connection times out on port 587. Some web hosts block outgoing SMTP ports. Ask your host to open port 587. On WordPress, you can use the SendLayer mailer in Easy WP SMTP or WP Mail SMTP instead. It sends with an API key over HTTPS, so it doesn’t need an SMTP port.

Why Microsoft Is Retiring Basic Authentication

Microsoft says Basic authentication makes it easier for attackers to steal and reuse passwords. It also makes multifactor authentication (MFA) hard or impossible to enforce.

Here’s why a password-based login is risky for sending apps:

• The password is often saved in plain text in an app’s settings or on a device
• One stolen password gives an attacker the whole mailbox, not just email sending
• Attackers can guess passwords with brute-force attacks
• There’s no way to limit what a stolen password can access

Microsoft already turned off Basic authentication for other Exchange Online protocols, like POP, IMAP, and Exchange ActiveSync. SMTP AUTH is one of the last ones left.

Understanding Modern Authentication (OAuth 2.0)

Modern authentication, also called OAuth 2.0, changes how an app proves it’s allowed to use your account. With Basic authentication, the app stores your password. With OAuth, it never sees it.

Think of OAuth 2.0 like a hotel key card. Instead of handing out copies of your master key (your password), you issue key cards (tokens) that:

• Only work for specific purposes
• Can be revoked individually if one is lost
• Expire automatically after a set time
• Work with multifactor authentication

When you set up an app with OAuth 2.0, you sign in on Microsoft’s own login page and approve what the app can do. The app then gets a token it uses to send emails on your behalf. You can see which apps have access and remove them at any time in your Microsoft account settings.

OAuth is more secure, but it takes more setup than typing a username and password. That’s why many teams pick an SMTP service for devices and simple plugins, and keep OAuth for apps that support it.

Next Steps

For Microsoft 365, Basic authentication for SMTP AUTH turns off by default at the end of December 2026. Personal Outlook.com and Hotmail accounts already require OAuth. Here’s what to do based on your situation:

For WordPress users: Install Easy WP SMTP Pro and use the One-Click Setup in the 365 / Outlook mailer. Or switch to SendLayer and keep your existing SMTP setup.

For developers and businesses: Switch app emails to SendLayer or another transactional email service, or move your code to OAuth or the Microsoft Graph API. If you write your own code, our tutorial shows how to send emails with Python through SendLayer. Try SendLayer free to see if it’s right for your needs.

For printers, scanners, and older apps: Check with the manufacturer for an OAuth update first. If there isn’t one, point the device at an SMTP service like SendLayer using the steps above.

Whatever you choose, make the switch before the deadline so you have time to test each app.

Need help deciding? Our team is happy to help you decide if SendLayer is the right fit for your needs. Just reach out through our support channels.

Frequently Asked Questions

These are some of the most common questions users ask about Microsoft retiring Basic authentication:

Rachel Adnyana

Rachel has been writing about WordPress for a decade and building websites for much longer. Alongside web development, she's fascinated with the art and science of SEO and digital marketing.

See Full Bio