# Evidence register (fetched Sun 18 Oct 2026, America/Phoenix)

Labels: **[V]** the build opened the page and the text is on it. **[P]** third-party write-up. **[A]** vendor claim. **[G]** guess. "Not verified" means exactly that.

## 1. Microsoft dates [V]
Source: Microsoft 365 Messaging Team, "Updated Exchange Online SMTP AUTH Basic Authentication Deprecation Timeline", Jan 27 2026 (updated Jan 29 2026), https://techcommunity.microsoft.com/blog/exchange/updated-exchange-online-smtp-auth-basic-authentication-deprecation-timeline/4489835 (opened directly in this run)

> - Now to December 2026: SMTP AUTH Basic Authentication behavior remains unchanged.
> - End of December 2026: SMTP AUTH Basic Authentication will be disabled by default for existing tenants. Administrators will still be able to enable it if needed.
> - New tenants created after December 2026: SMTP AUTH Basic Authentication will be unavailable by default. OAuth will be the supported authentication method.
> - Second half of 2027: Microsoft will announce the final removal date for SMTP AUTH Basic Authentication.

Microsoft's Learn page "Deprecation of Basic authentication in Exchange Online" currently points readers to that post as the current milestone list [V]: https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online

Not found: an exact day in December 2026 (Microsoft says "end of December"), and any statement about which tenants flip first or whether Microsoft will email each tenant. [not verified]
Third-party summaries (Marconet says "Q3 or Q4 2027" for permanent disable) differ from Microsoft's wording; we use only Microsoft's. Xerox says "permanently disable" beginning December 2026; that is not Microsoft's wording.

## 2. The SMTP AUTH clients report
**[V] Microsoft Learn, "SMTP AUTH clients report in the new EAC in Exchange Online"** https://learn.microsoft.com/en-us/exchange/monitoring/mail-flow-reports/mfr-smtp-auth-clients-report
- Location: Reports > Mail flow in the new EAC. Default range last 7 days; "You can specify a date range up to 90 days."
- The "Messages sent using SMTP Auth" section shows: Sender address; Domain; Authentication Protocol ("Values are either Basic Auth or Modern Auth. Basic Auth is TlsAuthLogin and Modern Auth is XOAUTH2."); TLS 1.0 (percentage); TLS 1.1 (percentage); TLS 1.2 (percentage); Messages sent.
- "Click Export to export the displayed results to a .csv file."
- Permissions: Compliance Administrator, Exchange Administrator, Organization Management, Security Administrator, Security Reader, View-Only Recipients (mail flow reports page, [V]).

**NOT verified:** the literal header row of the exported CSV. Microsoft's page lists UI column labels only and shows no sample CSV. We could not find any Microsoft sample output. The parser matches headers loosely (case, spaces, underscores, synonyms), rescues renamed columns from their values, and says so on screen. It is labelled unverified in the UI, in the tests (`verified === false`) and in this register.

**[P] "Request Report" (detailed per-message file):** columns `date, message_id, senderName, senderDomain, tls_version, tls_cipher, original_client_ip, authMethod, message_count`, with `authMethod` values `TlsAuthLogin` or `XOAUTH2`; IPs shown as "PII" unless a tenant setting is changed. Source: https://itpro-tips.com/end-of-life-for-basic-smtp-authentication-august-2025-update-report-and-powershell/ (a blog; not Microsoft). Not on the Microsoft Learn page we read.
**[P/unverified] PowerShell `Start-HistoricalSearch -ReportType SmtpCSReport`:** given by the same blog. Microsoft Learn's Start-HistoricalSearch page (fetched) lists ReportType values ATPReport, ConnectorReport, DLP, MessageTrace, MessageTraceDetail, OutboundSecurityReport, P2SenderAttribution, SPAM, Spoof, TransportRule, UnifiedDLP and **does not list SmtpCSReport**. Not used in the kit's script; the runbook mentions it only as unconfirmed.

## 3. Settings and cmdlets [V] (https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission)
- `Set-TransportConfig -SmtpClientAuthenticationDisabled $true` disables SMTP AUTH org-wide; `$false` enables. Check: `Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled`.
- Per mailbox: `Set-CASMailbox -Identity <id> -SmtpClientAuthenticationDisabled <$true|$false|$null>`; "The mailbox setting takes precedence over the organization setting"; `$null` follows the org.
- Listing: `Get-CASMailbox -ResultSize unlimited` and filter on `SmtpClientAuthenticationDisabled` (-eq $true / $false / $null).
- "If security defaults is enabled in your organization, SMTP AUTH is already disabled in Exchange Online." "If your authentication policy disables basic authentication for SMTP, clients cannot use the SMTP AUTH protocol even if you enable the settings."
- Admin UI: Microsoft 365 admin center > Users > Active users > Mail > Manage email apps > Authenticated SMTP.

## 4. Fix paths (all [V] from Microsoft Learn unless marked)
- Four methods and their limits (client submission, relay, Direct Send, HVE): https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365
  - Client submission limits: "10,000 recipients per day. 30 messages per minute." TLS 1.2/1.3 required; port 587 or 25; port 465 unsupported.
  - Relay: port 25, MX endpoint, connector by certificate or static IP; "Doesn't require a licensed Microsoft 365 or Office 365 mailbox"; not for third-party hosted services; "Reasonable limits".
- HVE: https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/high-volume-mails-m365 : internal recipients only; $0.000042 per recipient; billing policy required; Basic or OAuth; smtp.hve.mx.microsoft:587; up to 100 accounts; 50 recipients/message; 10 MB; Worldwide cloud only.
- OAuth for SMTP: https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth : scope `https://outlook.office.com/SMTP.Send` (user flows) and client-credentials with `SMTP.SendAsApp` and `https://outlook.office365.com/.default`.
- Graph sendMail: https://learn.microsoft.com/en-us/graph/api/user-sendmail?view=graph-rest-1.0
- Azure Communication Services retirement: https://learn.microsoft.com/en-us/azure/communication-services/acs-retirement-and-breaking-changes-guide : announced Sep 23 2026; ACS Email retires Sep 30 2028; onboarding limits from Oct 23 2026 for customers without a pre-existing ACS resource (the page also says new ACS Email resources can still be created "subject to change at any time"); Microsoft names HVE (internal) and Exchange Online as alternatives and lists Infobip and Telesign (Blip appears in the table) as Marketplace partners.

## 5. Device vendors (see guides/)
HP [V page; claims HP's], Brother [V], Canon [V manual page], Ricoh [V, claims Ricoh's], Xerox [V partial table], Konica Minolta [V, table garbled in extraction], WP Mail SMTP [V page; claims vendor's]. No device was tested.

## 6. Not researched / open
Third-party relay vendor prices and terms; other printer brands (Kyocera, Sharp, Lexmark, Epson, Toshiba); HP LaserJet Pro; GCC/sovereign-cloud differences (HVE is Worldwide only); how many tenants are affected; Microsoft's per-tenant notification mechanism; whether Microsoft will move the date again.

## 7. Verbatim quotes behind runbook sections 5 to 10 (all re-opened Sun 18 Oct 2026, America/Phoenix; each is on the named page)
**Device page** (https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365) [V]
- OAuth recommended: "Authentication: We recommend using Modern authentication in the form of OAuth."
- OAuth/licensed mailbox: "Mailbox: You need a licensed Microsoft 365 or Office 365 mailbox that the device uses to send email from." and "Verify SMTP AUTH is enabled for the designated mailbox."
- Client submission limit: "10,000 recipients per day. 30 messages per minute."; "If your device or application recommends or defaults to TCP port 465, it doesn't support the required versions of TLS"; "Your device or application must support TLS 1.3 or TLS 1.2."
- Send As: "5.7.60 SMTP; Client doesn't have permissions to send as this sender."
- Relay: "Doesn't require a licensed Microsoft 365 or Office 365 mailbox to send email."; "Reasonable limits are imposed for sending email messages."; "You can't use SMTP relay to send email from a third-party hosted service"; Sent Items column: relay "No"; SPF: "you need to add an SPF record for your domain" (certificate connector) and "add this IP address as a message source in the SPF record" (IP connector).
- Relay IP: "Requires static unshared IP addresses (unless a certificate is used)."
- Direct Send: "Most customers don't need to use Direct Send. We're working on an option to disable Direct Send by default to protect customers."; "Sends email to Microsoft 365 or Office 365 recipients only."; "Messages are just like anonymous email from the internet".
- Own server: "Windows Server 2022 is the last version of Windows Server that has the SMTP server feature (in IIS 6.0). As this is still unsupported for relaying email to Microsoft 365 or Office 365, use a supported version of Exchange Server or Azure Communication Service."
- The page says nothing about device firmware being the cause of TLS failures: runbook labels that [G].

**HVE page** (https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/high-volume-mails-m365) [V]
- "Do not assign licenses to HVE accounts. HVE accounts do not require Microsoft 365 licenses and shouldn't be treated as user mailboxes."
- "HVE account does not have a mailbox and cannot receive email. If recipients need to reply to messages sent by an HVE account, configure a Reply-To address for the account."
- "HVE accounts can authenticate even when SMTPClientAuthenticationDisabled is set to True in TransportConfig, because HVE uses a dedicated SMTP endpoint."
- "If Security Defaults are enabled in Microsoft Entra ID, all basic authentication methods (including SMTP) are disabled. In this configuration, HVE can authenticate only by using OAuth."

**Graph page** (https://learn.microsoft.com/en-us/graph/api/user-sendmail?view=graph-rest-1.0) [V]
- Permission table lists `Mail.Send` (delegated and application). "A 202 Accepted response code indicates that the request has been accepted; however, it doesn't indicate that the request processing has completed."

**OAuth page** (https://learn.microsoft.com/en-us/exchange/client-developer/legacy-protocols/how-to-authenticate-an-imap-pop-smtp-application-by-using-oauth) [V]
- Page contains `SMTP.SendAsApp`, scope `https://outlook.office365.com/.default`, `New-ServicePrincipal -AppId <APPLICATION_ID> -ObjectId <OBJECT_ID>`, and `Add-MailboxPermission -Identity "john.smith@contoso.com" -User $EXOServicePrincipal.Identity -AccessRights FullAccess`.

**SMTP AUTH page** (https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission) [V]
- "If security defaults is enabled in your organization, SMTP AUTH is already disabled in Exchange Online. To use SMTP AUTH, you need to disable security defaults."
- "The mailbox setting takes precedence over the organization setting." ($true disables, $false enables, $null follows the org.)
- "If your authentication policy disables basic authentication for SMTP, clients cannot use the SMTP AUTH protocol even if you enable the settings outlined in this article."
- The page does NOT say a mailbox override of $true blocks OAuth client submission. That is the runbook's inference, labelled [I].

**Deprecation page** (https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online) [V]
- "Basic authentication makes it easier for attackers to capture user credentials (particularly if the credentials aren't protected by TLS), which increases the risk of those stolen credentials being reused against other endpoints or services."
- "Although SMTP AUTH is currently available, Microsoft has announced plans to retire Basic authentication for SMTP AUTH in Exchange Online." and it links the Jan 2026 timeline post.

**HP support page** (https://support.hp.com/us-en/document/ish_13623350-13600809-16) [A: vendor claim]. Read in the original build run; a re-fetch on 18 Oct returned HTTP 500, so the "expires at regular intervals" and "Authenticated SMTP" statements are recorded as HP's claims, not re-confirmed.