Microsoft 365 SMTP Cut-off: Monaco

At the end of December 2026, Microsoft plans to switch off "basic authentication" for SMTP AUTH in existing Microsoft 365 tenants by default. In plain terms: any website, printer, scanner, booking tool or old script that sends email through your Microsoft 365 account using just a username and password may quietly stop sending.

The most common casualty is the one that hurts most: the contact form on your website. It still looks fine to visitors, it still says "Thank you, we'll be in touch", and the enquiry never reaches your inbox. For a Monaco business where a single lead can be worth a year of marketing spend, that is the real risk here. You have around eight weeks to check, and the fix is usually small.

What Microsoft is changing, and when

SMTP AUTH (also called "client submission") is the method many devices and applications use to send mail through Exchange Online: they connect to smtp.office365.com and log in with a mailbox address and password. Microsoft has wanted to retire this password-only login for years, because stolen passwords are the easiest way into a mailbox.

The timeline has moved several times. The plan to begin rejecting these logins in March 2026 was put on hold in January 2026. According to Microsoft's updated guidance, as reported by the Exchange team and widely covered by Microsoft 365 specialists:

• Until the end of December 2026: nothing changes.
• End of December 2026: basic authentication for SMTP AUTH is disabled by default in existing tenants. Administrators can turn it back on.
• New tenants created from that point cannot use basic authentication for SMTP AUTH at all and must use OAuth.
• Second half of 2027: Microsoft says it will announce a final date for removing basic authentication completely.

So the December change is reversible — for now. But "an administrator can re-enable it" assumes someone notices the problem, knows the cause, and has admin access on a holiday weekend. Microsoft's dates have shifted before, so check the latest notice in the Message centre of your Microsoft 365 admin centre or ask your IT provider to confirm.

Why Monaco businesses should care

Microsoft 365 is the default office suite in the Principality. Family offices, real estate agencies, yacht brokers, law firms, hotels and fiduciaries in Monaco overwhelmingly run on Outlook and Exchange Online, often set up years ago by an external provider who is no longer involved.

Website forms are frequently wired to a mailbox password. On WordPress sites in particular, a mail plugin is often configured with smtp.office365.com, port 587 and the password of an info@ mailbox. It worked in 2019 and nobody has touched it since. The same pattern appears on custom PHP sites, booking engines and some CRMs.

The failure is silent. When a form cannot send, many setups show the visitor a success message anyway. You only find out when a client asks why nobody replied to their request about the apartment, the charter or the table for twelve.

It touches your data obligations too. Under Monaco's Law No. 1.565 of 3 December 2024, supervised by the APDP, businesses must apply security measures appropriate to the risk. A mailbox protected only by a password that is stored in plain text inside a website plugin is hard to defend. We are not lawyers, so confirm your precise obligations with a qualified adviser, but moving to modern authentication points in the right direction. Our APDP data protection page covers the wider picture.

Find out if you are affected

Make a list of everything that sends email "as" your company, not only your staff in Outlook:

1. Website contact, quote and booking forms — on every site and sub-domain you own.
2. Printers and scanners using "scan to email".
3. Online shops sending order confirmations through your mailbox.
4. CRMs, booking systems, accounting tools and alarm or CCTV systems with an SMTP setting.
5. Scripts and automations set up by a former developer or IT provider.

For each one, look for a mail setting that mentions smtp.office365.com together with a username and password. Your Microsoft 365 administrator can also check sign-in logs for SMTP client submissions using basic authentication, which shows exactly which accounts and devices are still relying on it. If nobody in the company has admin access to your own tenant, fix that first.

Then do the simplest test of all: fill in your own website form today and confirm the email arrives. Repeat it after any change.

How to fix it, from simplest to most robust

Switch the website to OAuth. Most reputable WordPress mail plugins and modern frameworks support sending through Microsoft 365 with OAuth (via an app registered in Microsoft Entra ID) or through the Microsoft Graph API. No mailbox password is stored on the website at all. This is the cleanest fix for most sites and is usually part of routine website maintenance.

Use a dedicated transactional email service. For websites and shops sending order confirmations, password resets or notifications, a transactional email provider is often more reliable than a staff mailbox, with delivery logs to prove what was sent. Set it up with proper SPF, DKIM and DMARC records for your domain so messages don't land in spam.

Handle devices that cannot do OAuth. Older printers and scanners often can't be updated. Options include Microsoft's own alternatives for internal mail, a third-party SMTP relay, or replacing the device. Your IT provider should choose based on your setup.

Avoid the "just re-enable it" trap. Turning basic authentication back on in January may restore service quickly, but it only postpones the problem to whenever Microsoft announces final removal, and it keeps the weakest login method open on your tenant.

A sensible timetable for the next eight weeks

• This month: build the inventory, test every form, and identify who has admin rights to your Microsoft 365 tenant.
• Before mid-December: move websites and shops to OAuth or a transactional service; agree a plan for devices.
• Last week of December: submit each form again and check the logs. Plan for someone to be reachable in the first days of January.
• Ongoing: add "test the contact form" to your monthly maintenance checklist. It is the cheapest insurance a lead-driven business can buy.

If your website was built by a provider who has since disappeared, this is a good moment to review how it is maintained overall. Our web development team regularly takes over sites like this, and for businesses whose enquiries flow into a CRM, our email marketing & CRM work covers making sure every lead lands where it should.

Not sure how your website sends its emails? Get in touch and we'll check your forms and tell you exactly what needs to change before the end of December.