Exchange Online: Plan for Basic Auth Shutdown

[May 11, 2022: An updated summary and resources for Microsoft’s latest Basic Authentication shutdown plan is at https://www.directionsonmicrosoft.com/roadmap/ref/exchange-online]

• Some e-mail-enabled devices and software could break when Exchange Online drops Basic Authentication for most protocols starting Oct. 1, 2022.
• Companies should check their exposure and possibly opt out of shutdown tests planned by Microsoft in early 2022.

Basic Authentication, which sends a username and password to Exchange Online on each connection, will be shut down for most mail protocols beginning Oct. 1, 2022. It will be replaced with so-called Modern Authentication based on OAuth 2.0. The accompanying timeline shows major milestones in Microsoft’s shutdown plan announced Sept. 2021. Removal of Basic Authentication will improve protection against brute-force attacks on passwords and set up support for Microsoft multifactor authentication. However, it will break some third-party applications and services that access Exchange Online. Organizations should start finding and replacing any that they rely on.