Basic Authentication Is Gone in Exchange Online — Here's What Breaks and How to Fix It

If something in your office quietly signs in with just a username and password — an old scanner, a printer that emails, a script someone wrote years ago — it's living on borrowed time. Basic authentication has been retired in Exchange Online, and modern authentication is now the only way in.

What "basic auth" was

Basic authentication meant an app or device sent a plain username and password to sign in. Simple, and exactly the problem — it can't do multi-factor, it can't be protected by Conditional Access, and stolen credentials work instantly. It was one of the most common ways attackers got in.

What breaks

• Multifunction printers and scanners that "scan to email."
• Old line-of-business apps that send mail through Exchange.
• Scripts and integrations using stored username/password credentials.
• Very old email clients that never moved to modern auth.

What to do

Find what's still using it first — the sign-in logs will show you legacy authentication attempts. Then, for each one: move it to modern authentication (OAuth) where the vendor supports it, switch mail-sending devices to a supported method, and replace stored-password scripts with app registrations that use OAuth. For genuinely stuck legacy devices, an internal relay is a safer bridge than leaving basic auth open.