Microsoft Is Turning Off Basic SMTP Sign-In. What Breaks in a Real Estate Office?

The short version

If your brokerage, team, or lending office runs on Microsoft 365, some of the things that send email on your behalf may stop working at the end of December. Not your agents' Outlook. The quieter senders: the office copier that scans to email, the website form that emails new leads, the older app that sends closing reminders from a shared mailbox.

Many of those senders sign in to Microsoft with a plain username and password over a protocol called SMTP AUTH. Microsoft is retiring that kind of sign-in for Exchange Online. When it stops working, the failure is easy to miss. A lead form that used to email the team just goes quiet.

What Microsoft announced

Microsoft has moved this date more than once, so it is worth being precise. According to Tony Redmond's January 2026 write-up of Microsoft's updated timeline at Office 365 for IT Pros:

• Existing Microsoft 365 tenants: basic authentication for SMTP AUTH client submission keeps working until the end of December 2026, when Microsoft disables it.
• Temporary reprieve: tenant administrators can re-enable basic authentication for apps and devices after the December block.
• Final removal: Microsoft says it will announce the final date in the second half of 2027.
• New tenants: tenants created from the end of December 2026 cannot use basic authentication with SMTP AUTH at all. Apps and devices must use OAuth, Microsoft's modern sign-in method.
• Scope: this applies to Exchange Online, not to on-premises Exchange servers.

Earlier plans to start rejecting messages in March 2026 were dropped, which is why some offices heard about this, saw nothing happen, and moved on. The December date is the one to plan for.

Where this hides in a real estate operation

Real estate offices tend to accumulate small senders over the years, each set up once by whoever was handy and then forgotten. Common places to look:

• Copiers and scanners that scan contracts, disclosures, or ID copies straight to an agent's inbox.
• Website and landing page forms that email new inquiries to a shared mailbox or a lead coordinator.
• Older CRMs, transaction tools, and accounting apps configured to send through an Office 365 mailbox with a stored password.
• Scripts and scheduled jobs, such as a nightly report a team lead or office manager set up years ago.
• Shared mailboxes like info@, leads@, or closings@ that an outside tool logs into directly.

For a private lender or investor operation, add document request notices, payoff reminders, and draw notifications to that list. Anything that emails a borrower or a seller automatically deserves a check.

A practical plan for the next ten weeks

1. Build the list

Write down every device and app that sends email without a person clicking send. Ask your office manager, your transaction coordinator, and whoever manages the website. Your Microsoft 365 administrator can also review sign-in activity to find apps still using basic SMTP sign-in. One page is enough. The point is to know what exists.

2. Sort each sender into one of three buckets

• Can switch to modern sign-in. Many current apps support OAuth with Microsoft 365. Often this is a settings change and a reconnect.
• Can switch to a different sending route. For a device or app that cannot use OAuth, the Office 365 for IT Pros article points to using a different SMTP service for that sender. Website forms and notification tools usually work well with a dedicated sending service on your own domain.
• Should be retired. If nobody can say what a sender does or who reads its mail, turn it off on purpose now rather than discover it broke in January.

3. Test before December, not after

Change one sender at a time and confirm the mail arrives. Send a test form submission. Scan a page to email. Trigger a reminder. Write down what you changed and where the credentials now live.

4. Do not lean on the re-enable switch

Turning basic authentication back on after the block may buy time for a stubborn device. It is a reprieve, not a fix, and Microsoft has said a final removal date is coming. Treat it as a short bridge with an end date of your own.

Why this is worth an afternoon

A missed lead notification or an unsent document request does not throw an error that anyone sees. It just costs a response that should have gone out. The work here is not complicated, but it is the kind that slips because no one owns it.

It also tends to clean up two other problems at once: passwords stored in old tools, and email sent from your domain by systems nobody is watching. Both matter for deliverability and client data.

Get it handled

Genesis AI sets up and manages Microsoft 365, email sending, and AI workflows for brokerages, teams, and private lending operations. If you would rather hand off the inventory and the fixes before the December cutoff, reach out to the Genesis team and we will walk through what your office has running.