Mail sent with a password: the Microsoft 365 change that reaches a deal

At the end of December 2026 Microsoft turns off, by default, the oldest way of sending mail through Exchange Online: a program signing in to a Microsoft 365 mailbox with a plain username and password, known as SMTP AUTH with Basic authentication. Administrators can turn it back on for now, and Microsoft will announce the date of final removal in the second half of 2027. In most companies this is an IT ticket. Around a sale it reaches further than that, because the systems that send mail this way are often the ones that talk to customers, and because the months after closing are exactly when tenants are merged, split and moved.

This note is for owners preparing a sale, buyers reading a target and the advisors between them. How to find every such sender and move it to OAuth, a relay or a separate service is an engineering question, and our engineering partner covers it step by step in Microsoft 365 turns off SMTP AUTH Basic authentication in December 2026. Here we look at what the change does to a deal.

The dates

The schedule comes from the Exchange Team blog of January 2026, which replaced two earlier dates. We keep it, with other dates that matter to owners, on our page of technology deadlines for owners.

Why it reaches a deal

Three things make an otherwise small change worth a line in a review.

The first is what sends the mail. In a software company or a business that sells online, the senders are rarely only office scanners. They are the product's own notifications, password resets, order confirmations, invoices and the contact form that brings in leads. When one of them stops, the effect is on customers and revenue, and in the worst case nobody notices for days, because a form that shows "thank you" whether or not the email left looks healthy from the outside.

The second is the new tenant rule. A target that is carved out of a group, rebranded or moved into the buyer's Microsoft 365 often ends up in a tenant created after December 2026, where Basic authentication is not available by default. Every program that still signs in with a password breaks at the moment of migration, in the middle of the integration, when the team is already stretched. How shared systems are separated in a carve-out is covered in Carve-outs and shared systems in due diligence.

The third is timing. Microsoft has said the final removal date will be announced in the second half of 2027. For a deal signed in 2026 or early 2027, that announcement and the work it forces are likely to land in the buyer's first year of ownership. Work that has to be done anyway is better priced before closing than discovered after it.

What a reviewer looks at

On outgoing mail, a reviewer usually asks a short list of questions, and most of them can be answered in a day:

• The list of senders: Microsoft's SMTP AUTH clients report in the Exchange admin center shows every address that sends with a password over the last 90 days. A target that can produce it, matched to systems and owners, is in a different position from one that has never opened it.
• Customer-facing mail: which of the senders are the product, the store or the billing, and whether a failed send is logged and retried or simply lost.
• Shared passwords: how many configuration files, plugins and devices hold the password of the same shared mailbox, and how many former employees and contractors have seen it. This is a security finding in its own right, whatever Microsoft decides.
• Who owns the accounts: whether the Microsoft 365 tenant, the domain and the sending services are registered to the company or to a founder, an agency or a former developer. This is part of the wider question in Ownership gaps in a software acquisition.
• The plan: whether each sender has a route after December, OAuth, a relay connector, an internal-only service or a separate sending provider, with a date and a person, or whether the plan is to turn Basic authentication back on and wait.

How it turns into deal terms

On its own, this change rarely moves a price. The cost of moving a few senders to OAuth or a separate service is usually small next to the value of a company. It becomes a deal point in three situations: when customer-facing mail depends on it and failures are not logged, when the company is about to change tenants after closing, and when the review finds the same shared password everywhere and nobody who can say where it has been. Then the familiar mechanisms apply: a condition that the seller moves the critical senders before closing, a line in the integration plan with an owner and a budget, or a disclosure with the plan attached. The choice is for the parties and their lawyers. The reviewer's job is to give them the list, the risk and the effort. How findings become the buyer's first months of work is in From due diligence to the 100-day plan.

What a seller can do now

For an owner planning a sale in 2027, this is one of the cheapest findings to close before a buyer sees it:

1. Run the report. Ask your Microsoft 365 administrator for the SMTP AUTH clients report for the last 90 days and keep the export.
2. Match each sender. Write down which system, device or script is behind each address, and who is responsible for it.
3. Move the customer-facing mail first. Product notifications, orders, invoices and lead forms get their own route and a log of every message, so a failed send is visible.
4. Change the shared passwords once the senders are moved, and remove them from every place they no longer need to be.
5. Put it in the data room. A short page with the list of senders, the routes and the dates answers the reviewer's questions before they are asked. Our note on the technical section of a data room shows where it goes.

This is the kind of work a technical baseline before the banker covers, and what our exit readiness program runs month by month.

What a buyer can do

A buyer reading a target in the coming months can add outgoing mail to the review scope at almost no cost: ask for the SMTP AUTH clients report early, ask which senders are customer-facing, and check whether the integration plan moves the target to a new tenant. If it does, every password-based sender goes on the list of things to change before the move, not after it. A red-flag memo early in the process, or a full technical due diligence, puts it on the table while it can still be planned.

A short checklist

• The SMTP AUTH clients report for the last 90 days, exported.
• Each sending address matched to a system, a device or a script, with a responsible person.
• Customer-facing senders identified, with logging of failed sends.
• A route for each sender after December 2026, with a date.
• Shared mailbox passwords changed after the move.
• Ownership of the tenant, the domain and the sending services confirmed.
• For a buyer: whether the target will move to a new tenant after closing, and when.

Questions