Microsoft 365/Exchange Online Critical Update Required
Notification: Microsoft 365 Update Required:
Microsoft 365/Exchange Online Critical Update Required:
Millions of professionals can experience sudden email sync failures due to major infrastructure changes implemented by Microsoft. If your office utilizes ERP software for tasks such as emailing, scanning to email from copiers and multifunction printers, or handling automated device alerts, it’s important to note that a forthcoming change in Microsoft security may affect your daily operations.
Note: If you email from the IBM i with Microsoft 365, inFORM Decisions has a solution for OAuth Authentication to keep you emailing from the IBM i.
Microsoft is conclusively retiring Basic Authentication for SMTP AUTH in Microsoft 365 and Exchange Online. In order to provide its users ample time to prepare, this was originally posted by Microsoft in the Microsoft 365 message center on April 15 2024.
“Exchange Online will retire Basic Auth for Client Submission (SMTP AUTH) in September 2025. Users must switch to OAuth or other alternatives before this date, as applications using Basic Auth will no longer be supported”.
Once this change is fully enforced, many applications and devices—such as printers, scanners, and multifunction devices—that send email using stored usernames and passwords will no longer work unless they are updated or reconfigured.
This is not a vendor-specific decision. It is a mandatory Microsoft security update, and planning ahead is the best way to avoid unexpected disruptions.
Why Microsoft Is Making This Change:
Many copiers, scanners, and ERP applications now send email utilizing Basic Authentication, a simple login mechanism that uses a previously recorded username and password. Static credentials were designed for recordkeeping in isolated systems, not for securing interconnected, AI driven, and automated environments. With today’s Cybersecurity threat landscape, their unchanging nature makes them predictable targets for automated attacks. These static credentials make it vulnerable to:
• Credential theft
• Brute-force attacks
• Unauthorized access
Modern Authentication:
Microsoft is replacing Basic Authentication with a Modern Authentication secure, token-based, multi-factor identity verification system that replaces legacy password-only methods and supports adaptive, context-aware access controls called OAuth 2.0.
While OAuth 2.0 is the underlying framework, Microsoft OAuth is the vendor-specific provider (via Entra ID) requiring app registration and access tokens. Entra ID is the authentication server also known as the identity provider (IdP). It securely handles anything to do with the user’s information.
Aftermath:
After Microsoft’s retirement date, any device still using Basic Authentication will fail to send email. That includes:
• ERP email applications
• Scan-to-email from copiers and MFPs
• Automated alerts and notifications from devices
• Applications that authenticate using stored credentials
When this happens, users may see errors such as “550 5.7.30 Basic authentication is not supported for Client Submission.”
Microsoft’s Official Timeline:
Microsoft has published a clear schedule for this change:
• Originally set for March 2026: SMTP AUTH Basic Authentication behavior now remains unchanged until December 2026.
• End of December 2026: SMTP AUTH Basic Authentication will be disabled by default for existing tenants. Administrators will still be able to enable it if needed.
• New tenants created after December 2026: SMTP AUTH Basic Authentication will be unavailable by default. OAuth will be the supported authentication method.
• Second half of 2027: Microsoft will announce the final removal date for SMTP AUTH Basic Authentication.
Engage Your Email Administrator:
Because this change affects Microsoft 365 at the tenant level, the first step should always be a conversation with your Email Administrator or Managed Services Provider.
They can help determine:
• Whether your Microsoft 365 tenant uses SMTP AUTH
• Whether Basic Authentication is still enabled
• Whether scan-to-email or device notifications are currently at risk
Remediation:
1. Use Modern Auth (OAuth 2.0): Update your application, software, or device settings to support Modern Authentication/OAuth 2.0 if possible.
2. Switch to Authenticated SMTP Relay: If the device does not support OAuth, set up a Direct Send or SMTP Relay.
3. Update Firmware: Check if you’re MFP (Multi-Function Printer) or application has a firmware update that enables Modern Authentication. Major manufacturers have acknowledged Microsoft’s change and have published official guidance. Search for your specific model.
4. IBM i/Power System users of iMail from inFORM Decisions: Contact inFORM Decisions Customer Support for update instructions. iMail 8.2 3-13-26 includes Microsoft OAuth email authentication for Office 365 to iMail on the IBM i. OAuth 2.0 provides third-party applications secure delegated access to protected user resources without saving user credentials in the application.
In Conclusion:
This is a Microsoft security requirement, not an Enterprise Resource Provider (ERP) or printer manufacturer preference. Without proper planning, it has the potential to interrupt scan-to-email, automatic notifications, and daily document routines.
The good news is that with early detection and proper configuration, these difficulties can be completely avoided. inFORM Decisions has the capability to connect to Microsoft 365 using OAuth 2.0 for emailing with the iMail module.
This information has been presented by inFORM Decisions software developers for the IBM i and Power Systems for over 32 years.
Call (800) 858-5544 / (949) 709-5838 or visit us at www.informdecisions.com for more information about our acclaimed iDocs suite of IBM i products.
