In a drive to get to a point where they could finally flip the switch, Microsoft granted an exemption for SMTP AUTH to allow customers to continue using multi-function devices, programs, and scripts that use Exchange Online to send emails (switching to use Graph APIs is not difficult, but it takes time to find, upgrade, and test code). Compromises and Initiatives to Push the Project Along Exchange Online is a much safer place today because a much higher percentage of user accounts are immune from password spray and business email compromise (BEC) attacks, but there’s still lots of work to do. They’ve already disabled basic authentication for millions of tenants and the pace has quickened considerably over the last few months. Microsoft has been trying to remove support for basic authentication for seven email connection protocols (MAPI, RPC, Offline Address Book (OAB), Exchange Web Services (EWS), POP, IMAP, Exchange ActiveSync (EAS), and Remote PowerShell) for the last three years. It’s a great example of why herding cats is so difficult. This project affects how the largest Microsoft 365 workload operates across millions of tenants and hundreds of millions of individual users. The difficulties of bringing a large community through a fundamental technical transformation are vividly illustrated by the many steps in Microsoft’s campaign to eradicate basic authentication from Exchange Online.

No Basic Authentication for Microsoft 365 Apps for Enterprise.Compromises and Initiatives to Push the Project Along.

Exchange online modern authentication