If any of your business systems email invoices, statements, remittances, purchase orders or reports through a Microsoft 365 mailbox using a username and password, they may stop sending at the end of December 2026. Microsoft is switching off that sign-in method, called Basic authentication for SMTP AUTH, by default for existing Exchange Online tenants at that point. Your IT provider can switch it back on for now, but that only buys time: Microsoft says it will announce a final removal date in the second half of 2027. The fix is to list every system that sends email, find out how each one signs in, and move the ones using a password to a supported method before the Christmas shutdown.
What is changing, in plain English
Many business systems send email by logging in to one of your mailboxes, often a shared address such as accounts@ or invoices@, with a username and password typed into their email settings. Microsoft calls this "SMTP AUTH client submission" with "Basic authentication", and it's the last use of Basic authentication Exchange Online still allows, because a stored password is easy to steal and reuse. The current timeline, from Microsoft's message centre notice MC786329 and its Exchange Team blog post "Updated Exchange Online SMTP AUTH Basic Authentication Deprecation Timeline" (January 2026), is:
- Now to December 2026: nothing changes.
- End of December 2026: Basic authentication for SMTP AUTH is turned off by default for existing tenants. Administrators can still turn it back on if needed.
- New tenants created after December 2026: it isn't available by default. OAuth (a modern sign-in where the system gets a token instead of storing your password) is the supported method.
- Second half of 2027: Microsoft says it will announce the final date when Basic authentication for SMTP AUTH is removed completely.
The original plan was March 2026, so the date has already moved once. Plan for end of December anyway.
Why it matters to finance and operations
When this breaks, it rarely looks like an outage. The job system still says "invoice emailed" and the ERP still marks the purchase order as sent. The email just never leaves, or sits in an outbox with an authentication error nobody reads.
What you notice weeks later:
- Customers say they never got their invoice, and payments slow down.
- Monthly statements and overdue reminders didn't go out, so debtors drift.
- Suppliers didn't get remittance advice or purchase orders, and start calling.
- Managers stop getting the weekly sales or job cost report and assume nothing has changed.
The timing makes it worse: many Australian businesses are closed over the break, so it surfaces at the first billing run of the new year. If this sounds like a pattern you've seen before, our page on integrations that only half work describes how these quiet failures build up.
Which of your systems are likely to be affected
Anything that sends email using mail server settings you typed in yourself is a candidate. Common examples:
- Accounting add-ons and desktop software that email documents from your address, such as debtor management tools and statement runners.
- ERP, job management and stock systems, especially on-premises or older versions, that send invoices, quotes, picking slips or purchase orders.
- Custom apps and Access databases that send email from code, often written years ago with a mailbox password in a settings file.
- Report schedulers, such as SQL Server reports or scripts that email a spreadsheet or PDF each morning.
- Scanners and printers that scan to email. These are your IT provider's job.
Cloud accounting systems such as Xero and MYOB Business normally send invoice emails through their own mail service rather than your mailbox, so they're unlikely to be affected unless someone set up custom mail server details. The ones to worry about are the systems around your accounts.
How a finance person can find out what's at risk
You don't need to touch any Microsoft settings; your IT provider does that. What you can do is build the list of systems and documents, which IT providers usually can't do alone because they don't know which system sends which document.
- List every document that goes out by email. Invoices, credit notes, statements, overdue reminders, remittances, purchase orders, quotes, delivery dockets, payslips, scheduled reports. Next to each, write the system that sends it and the "from" address it comes from.
- Ask your IT provider for the SMTP AUTH Clients report. It's in the Exchange admin centre under Reports, Mail flow, and shows which addresses send email this way and whether each uses Basic auth or modern auth (OAuth). It covers the last 7 days by default and up to 90 days. Run it over a period that includes month-end, so monthly statement runs show up.
- Match the two lists. Any "from" address that appears in the report as Basic auth is a system you need to deal with. Anything on your list that isn't in the report may send some other way; ask the vendor.
- Ask each vendor, in writing: "Does your product send email using SMTP with a username and password, or OAuth / modern authentication? If it's password-based, what version or setting supports OAuth for Microsoft 365, and when?"
- Test before the deadline. Once a system has been changed, send a real document to an outside address you control and confirm it arrives. Don't trust the system's "sent" status.
Your options for each system
Work through these in order for each system; the first ones are usually cheapest.
- Turn on OAuth in the system. Many current products support it, labelled "Sign in with Microsoft", "OAuth" or "modern authentication" in the email settings. Your IT provider approves the system in Microsoft and you switch the setting. Usually the simplest fix.
- Update or upgrade the system. If your version doesn't support OAuth but a newer one does, this is the time to take the update. Check whether it's covered by your support agreement or needs a paid upgrade.
- Send through a dedicated sending service instead of your mailbox. Your IT provider sets it up, including the domain records that stop the emails being treated as spam. For internal-only email, such as reports to your own staff, Microsoft also suggests its High Volume Email service.
- Rebuild the sending step. For an old Access database, homegrown app or script, replace just the part that sends email so it uses a supported method or hands the document to a system that already sends properly. That's usually a contained piece of work, not a rewrite.
Your IT provider can switch Basic authentication back on after December if a system isn't ready. Treat that as a short reprieve: it keeps a weaker sign-in method running, and a final removal date is coming.
A dated checklist for the rest of 2026
Working back from the end of December and the Christmas shutdown:
- By Friday 6 November: finish the list of every document that goes out by email, the system that sends it and the "from" address.
- By Friday 13 November: ask your IT provider for the SMTP AUTH Clients report covering October's month-end, and match it against your list.
- By Friday 20 November: send the written question to each vendor whose system shows Basic auth. Ask your IT provider what they need to set up OAuth or a sending service.
- By Friday 4 December: decide the fix for each system (OAuth, update, sending service or rebuild) and book the work.
- By Friday 11 December: make the changes and test each document type by sending to an outside address. Include statements and anything that only runs monthly.
- Before the Christmas shutdown: agree with your IT provider what happens if something fails over the break, and who checks.
- First week back in January: run the first invoice and statement run, then confirm with a few customers that they arrived.
When it's worth getting help
If every system that sends email is a current product with an OAuth setting, your IT provider and a few vendor updates will get you through, and you probably don't need us.
It's worth getting help when:
- A system that sends key documents has no fix from its vendor, or the vendor no longer exists.
- The sending happens inside custom code, an Access database or a script that nobody fully understands.
- Documents go out from several systems and nobody is sure which one sends what, or the same customer gets statements from two places.
- You're already planning to replace the system, and it makes more sense to move the document sending into something else than to patch the old one.
Your IT provider handles the Microsoft 365 side. We deal with the business systems that send: changing or rebuilding how a job system, ERP, custom app or database sends documents. That sits within our third-party software integration work. If the change has exposed a wider tangle of systems, our Process & Systems Audit costs $5,000 and maps every system and process into a written report. For more on how connections between systems break when vendors change the rules, see our post on why MYOB integrations stopped working after the API change and the Xero and MYOB integration and migration guide.
Frequently asked questions
What is SMTP AUTH Basic authentication?
It's the old way for a system or device to send email through Exchange Online by signing in with a mailbox's username and password. The modern alternative is OAuth, where the system gets a token from Microsoft instead of storing your password.
When does Microsoft turn off SMTP Basic auth?
According to Microsoft's notice MC786329, it is disabled by default for existing tenants at the end of December 2026, and administrators can turn it back on for now. New tenants created after December 2026 won't have it by default. Microsoft says it will announce the final removal date in the second half of 2027.
Will Xero or MYOB stop sending invoices?
Usually not, because they normally send through their own mail service. The systems at risk log in to your own mailbox with a password: add-ons, ERP and job systems, custom apps and report schedulers.
Can we just keep using a username and password?
For a while. Your IT provider can re-enable it after December, but Microsoft has said it will be removed completely, with a date announced in the second half of 2027.
If you've found a system that sends your invoices or statements and can't be fixed by a setting, book a free initial chat. We'll tell you plainly whether an update will do or the sending step needs rebuilding.