Microsoft 365 for Cold Email in 2026: What Changed and What to Do

Correction, October 6, 2026: an earlier version of this article said Microsoft disabled Basic Auth for SMTP AUTH for every tenant on March 1, 2026, and that app passwords were already rejected. That was wrong. Microsoft postponed the change on January 27, 2026. This article now reflects Microsoft's current timeline and sending limits.

For years, Microsoft 365 (formerly Office 365) was a popular choice for cold email senders. Outlook's domain reputation, simple SMTP credentials, and broad compatibility with sales automation tools made it an easy option.

Those simple credentials are on a deadline. Microsoft is retiring Basic Authentication for SMTP AUTH in Exchange Online, and the date has moved several times. This guide covers the current timeline, what it means if your cold email setup sends through Outlook SMTP with a password, and what your options are.

What Is Changing, and When

In April 2024, Microsoft announced it would retire Basic Authentication for SMTP AUTH client submission (the smtp.office365.com endpoint that sequencers, scripts and devices log into) in September 2025. It later replaced that date with a gradual rollout: a small share of Basic Auth submissions rejected from March 1, 2026, reaching 100% on April 30, 2026 (Exchange Team blog).

That rollout did not happen. On January 27, 2026, Microsoft published a new timeline (Exchange Team blog, also Message Center MC786329):

Microsoft's stated reason is that many customers still face real challenges modernizing legacy email workflows. Printers, scanners and line-of-business apps that can't do OAuth yet are the usual examples (Office 365 for IT Pros).

SMTP AUTH is the last protocol still waiting. Microsoft began turning off Basic Auth for Exchange ActiveSync, POP, IMAP, EWS, Remote PowerShell and other protocols on October 1, 2022, and stopped letting tenants re-enable it after December 31, 2022. SMTP AUTH was left out of that change (Microsoft Learn).

Once Basic Auth for SMTP AUTH is off in your tenant:

• Password logins fail. A client that sends a username and password to smtp.office365.com gets 550 5.7.30 Basic authentication is not supported for Client Submission.
• App passwords stop working too. An app password is a form of Basic Auth. Microsoft notes that removing Basic Auth also prevents the use of app passwords. They work today where Basic Auth is allowed and stop when it is disabled.
• OAuth keeps working. SMTP AUTH itself stays. Clients authenticate with the XOAUTH2 mechanism and an OAuth 2.0 access token (Microsoft Learn).
• Normal Outlook use is unaffected. Outlook on desktop, web and mobile already uses modern authentication.

Many tenants can't use Basic Auth for SMTP even today. Microsoft disabled SMTP AUTH in tenants where it wasn't being used, and Security Defaults or a Conditional Access policy that blocks legacy authentication also rejects it. If your password-based connection works now, your tenant still allows it, and it will keep working until the default changes.

Who's Affected

Anyone who sends through Microsoft 365 over SMTP with a username and password, or an app password, needs a plan before the end of December 2026. Some groups have more work than others.

Sales Automation Tools

Most sequencers connect Microsoft 365 mailboxes through a Microsoft sign-in (OAuth). Basic Auth for IMAP was turned off in 2022, so any tool that reads replies from a Microsoft 365 mailbox over IMAP has needed OAuth for years. If you connected your mailboxes that way, this change doesn't affect you.

The setups that are affected log into smtp.office365.com on port 587 with an email address and password or app password: SMTP-only sending accounts added to a sequencer, or tools that never added a Microsoft sign-in option. Those still work today in tenants that allow Basic Auth. From the end of December 2026 they stop by default, and keep working only if an admin turns Basic Auth for SMTP AUTH back on.

Agencies Running Multiple Accounts

Agencies that send from Microsoft 365 mailboxes across many tenants have the most work. Each tenant needs either an admin who keeps Basic Auth for SMTP AUTH on after December, or an OAuth setup with admin consent. Both are more effort at scale than the old username and password approach.

Custom Scripts and Internal Tools

Development teams that built internal sending tools using Python's smtplib, Node.js's Nodemailer, or similar libraries with hardcoded Microsoft 365 SMTP credentials need to move their authentication to OAuth 2.0 or switch to the Microsoft Graph API.

Who Is NOT Affected

Senders using dedicated SMTP infrastructure (not Microsoft 365) are unaffected. Google Workspace users are not affected by this change. Google made its own version of it, turning off password-based access for less secure apps on all Google accounts on March 14, 2025, with app passwords as the remaining exception (Google Workspace Admin Help). Anyone already connecting to Microsoft 365 with OAuth 2.0 or the Graph API continues to work normally.

The OAuth 2.0 Problem

In theory, the solution is simple: switch from Basic Auth to OAuth 2.0. In practice, it adds real complexity, especially for cold email, where you may be managing many accounts.

What OAuth 2.0 Requires

To send email through Microsoft 365 SMTP using OAuth 2.0, you need (Microsoft Learn):

1. An app registration in Microsoft Entra ID (formerly Azure Active Directory). Your sequencer may already provide one. If you build your own, you create it, define its permissions (SMTP.Send when a user signs in, or SMTP.SendAsApp for app-only sending), and configure redirect URIs.
2. Tenant admin consent. App-only sending needs admin consent in each tenant, plus registering the app's service principal in Exchange Online and granting it access to each mailbox. For agencies, every customer's Microsoft 365 admin has to do this separately.
3. Token refresh handling. Access tokens last about 60 to 90 minutes by default (Microsoft Learn). Your application must refresh them automatically. Refresh tokens last 90 days and are replaced each time they're used, so a mailbox left idle for 90 days, or whose password changes, has to sign in again interactively (Microsoft Learn).
4. Conditional Access compliance. Many organizations have Conditional Access policies that can block token issuance from unrecognized devices, IP addresses, or locations. This is a common source of authentication failures that didn't exist with Basic Auth.

Tool Support Varies

Many sales automation platforms already offer a Microsoft OAuth connection. Check how yours handles token refresh failures and re-authentication, and whether it alerts you when a mailbox disconnects. If your tool only supports SMTP with a password, you'll need a different connection method or a different tool before the end of December 2026.

Even when a tool supports OAuth, setup takes more steps than entering an email and password: Entra ID configuration, admin consent, and periodic re-authentication when tokens expire. For agencies managing 50 or more Microsoft 365 accounts, that overhead adds up.

The Token Refresh Problem

The most common OAuth issue is silent token expiration. When a refresh token expires or is revoked (because the mailbox sat idle for 90 days, the password changed, a Conditional Access policy blocked it, or an admin changed the tenant's security settings), the SMTP connection stops working. Campaigns stop sending, and many teams don't notice until days later when they check their analytics.

This is different from Basic Auth, where credentials either worked or they didn't. OAuth introduces intermittent, time-delayed failures that are harder to monitor and debug.

Microsoft 365 Sending Limits in 2026

Microsoft's sending limits apply per mailbox, with a separate tenant-wide cap on external recipients. As of October 2026, the Exchange Online limits are:

Microsoft had planned a stricter per-mailbox cap of 2,000 external recipients per day (the Mailbox External Recipient Rate Limit) during 2026. On January 6, 2026, it cancelled that limit indefinitely and said the recipient rate limit and the tenant-level limit stay unchanged (Exchange Team blog).

On paper these limits are far above what a cold email mailbox should send. Microsoft's service description also says customers who need to send legitimate bulk commercial email should use third-party providers that specialize in it. For cold email, the limit that matters is reputation: about 10 to 20 cold emails per mailbox per day, whichever provider you use.

Your Options

A stopgap first. After the default changes at the end of December 2026, a tenant admin can turn Basic Auth for SMTP AUTH back on. That buys time until Microsoft's final removal date, which it plans to announce in the second half of 2027. It doesn't help where Security Defaults or Conditional Access block legacy authentication, tenants created after December 2026 won't have it by default, and the migration still has to happen eventually.

For the longer term, if you use Microsoft 365 for cold email today, you have three paths. Each has different tradeoffs around complexity, cost, and reliability.

Option A: Migrate to OAuth 2.0

Continue using Microsoft 365, but connect your mailboxes with OAuth 2.0. This means using your sequencer's Microsoft sign-in, or registering your own Entra ID application, configuring permissions, and getting admin consent.

Pros: Keep your existing Microsoft 365 accounts and domain reputation. No need to change email addresses or warm up new accounts.

Cons: Requires Entra ID admin access. Token refresh adds ongoing maintenance. Your tools must support it. Still subject to Microsoft's sending limits and its guidance that bulk commercial email belongs with specialist providers.

Option B: Use Microsoft Graph API

Instead of SMTP, send emails through Microsoft's Graph API. This is Microsoft's recommended approach for application-level email sending and the most future-proof option within the Microsoft ecosystem.

Pros: Full Microsoft support. Access to advanced features (read receipts, calendar integration). No SMTP configuration needed.

Cons: Even more complex than OAuth SMTP. Requires application-level permissions and admin consent. Most sales automation tools don't support Graph API natively. Sending limits remain the same. Custom development is typically required.

Option C: Switch to Dedicated SMTP Infrastructure

Move your cold email sending to purpose-built SMTP infrastructure for cold email. This means new domains, new email accounts, and a warmup period, but it removes the Microsoft dependency entirely.

Pros: No OAuth setup. No token refresh failures. Low cost per mailbox, so you add volume by adding mailboxes. Built for cold email. Automatic SPF, DKIM, and DMARC. Works with every sales automation tool that supports SMTP.

Cons: Requires new domains and email accounts. Warmup period before sending at full volume. Monthly cost for the SMTP service.

Option Comparison

For most cold email use cases, we still recommend Option C (dedicated SMTP), for cost and fit rather than urgency. You don't have to move today: password-based SMTP keeps working until the end of December 2026 where your tenant allows it. But if you'd have to rework Microsoft 365 authentication before then anyway, a 2 to 4 week warmup on dedicated infrastructure removes the OAuth maintenance for good, at a lower cost per mailbox.

How to Migrate from Microsoft 365 to SMTP

If you've decided to move cold email off Microsoft 365, here's a step-by-step plan that minimizes downtime and protects your sender reputation. Starting by mid-November 2026 leaves time to finish before Microsoft's default changes at the end of December.

Step 1: Set Up Dedicated SMTP Accounts

Sign up for a dedicated SMTP provider like Winnr. Provision your email accounts and domains. With Winnr, SPF, DKIM, and DMARC are configured automatically on every domain, so there are no DNS records to set up by hand. Plan for roughly the same number of sending accounts you had in Microsoft 365, or more if you want to spread volume further.

Step 2: Export Your Microsoft 365 Contact Lists

Before making any changes to your Microsoft 365 accounts, export your contact lists and campaign data from your sales automation tool. Most tools allow CSV exports of prospect lists, campaign sequences, and performance data. Keep this data as your migration reference.

Step 3: Connect SMTP Accounts to Your Sequencer

Add your new SMTP accounts to your sales automation tool using standard SMTP credentials (host, port, username, password). There is no OAuth setup or admin consent: it's the same credential-based setup many teams use with Microsoft 365 SMTP today, pointed at a different mail server. Major sequencers support SMTP accounts, including Instantly, Smartlead, Reply.io, and Salesforge.

Step 4: Warm Up New Accounts

New email accounts need a warmup period to build sender reputation. Plan on at least 2 weeks, and 4 on a brand-new domain. During warmup, start with low volume (5-10 emails per day per account) and increase gradually. If your SMTP provider has built-in warmup (Winnr has a warming add-on), enable it on all accounts from day one. On Winnr, plan for about 50 emails per day per mailbox including warmup, with 10 to 20 of those as cold email.

Step 5: Gradually Shift Campaigns

Don't switch everything at once. Start by routing new campaigns through your SMTP accounts while letting existing Microsoft 365 campaigns finish their sequences. As SMTP accounts complete warmup, shift more volume over. Within 3-4 weeks, you can fully transition.

Step 6: Keep Microsoft 365 for Business Email

Microsoft 365 remains a good fit for day-to-day business communication: internal email, client correspondence, calendar scheduling. The SMTP AUTH change only affects password-based SMTP sending, not normal Outlook use. Keep your Microsoft 365 licenses for business email and use dedicated SMTP for cold outreach. That separation is a good practice regardless of the authentication changes.

Microsoft 365 vs Dedicated SMTP: Updated Comparison

With Microsoft's current timeline and limits factored in, here's how Microsoft 365 and dedicated SMTP infrastructure compare for cold email specifically.

The cost difference is significant at scale. At Microsoft's US list prices, 50 sending accounts cost $200 a month on Exchange Online Plan 1 ($4 per user, annual commitment), or $350 to $700 a month on Microsoft 365 Business Basic or Business Standard ($7 or $14 per user since Microsoft's July 1, 2026 price update), before any sequencer costs. On Winnr's Startup plan, 50 email accounts cost $69 a month. For a side-by-side of the options, see our guide to Outlook and Microsoft 365 alternatives for cold email.

What This Means Going Forward

The SMTP AUTH change is part of a broader trend: large mailbox providers keep tightening the rules for anyone sending at volume. Google and Yahoo introduced bulk sender requirements in 2024. Since May 5, 2025, Outlook.com has required SPF, DKIM and DMARC from domains that send more than 5,000 messages a day to its consumer addresses (Microsoft Defender for Office 365 blog).

Microsoft is also changing how business inboxes sort mail. Under Message Center MC1279093, Microsoft Defender for Office 365 tags incoming promotional mail as "promotions" and, where an admin turns on bulk moves, moves it to a Promotions folder. Worldwide general availability is rolling out from late July to late October 2026, with tagging on by default. If you send cold email to companies on Microsoft 365, keep messages plain and personal rather than formatted like marketing mail.

Shared mailbox providers are optimizing for inbox users, not outbound senders. Each policy change, whether authentication, sending limits or filtering, makes cold email on shared infrastructure more work.

Dedicated SMTP infrastructure exists for this use case. It doesn't depend on a mailbox provider's authentication roadmap, and it's priced for running many mailboxes at low volume each.

You have until the end of December 2026 before Microsoft's default changes. Use that time to decide whether to rework Microsoft 365 authentication or move cold email to infrastructure built for it.

Related guides: Compare SMTP vs Google/Microsoft for cold email, read our cold email best practices guide, see why cheap Azure inboxes are getting blacklisted by SURBL, learn what to do if Google Workspace suspends your account, or check our sending limits by provider comparison.