What changes, and when
The dates are on Microsoft's Exchange Team blog (checked October 27, 2026).
- Now to December 2026: no change.
- End of December 2026: password sign-in for SMTP mail is turned off by default for existing Microsoft 365 tenants. Microsoft says admins can turn it back on.
- Second half of 2027: Microsoft will announce the final removal date. There is no final date yet.
So the deadline is soft. Turning it back on buys time, not a fix. Sign-in with OAuth (a token instead of a password) keeps working.
Am I affected?
Probably, if all of these are true:
- Your business email is on Microsoft 365 (Outlook).
-
Your website, plugin or script settings say
smtp.office365.com, often with port 587. - Those settings hold a mailbox username and password.
Common places: a WordPress SMTP plugin set to "Other SMTP", a PHP mailer, or a small Node or Python script. Printers and scanners that email scans are hit too, but their fix is a firmware update or a relay box, so we do not cover them.
The free fixes first
Most WordPress sites need only the first one.
- Your plugin's own Microsoft mode. FluentSMTP is free and connects to Microsoft 365 with OAuth. WP Mail SMTP has a Microsoft 365 / Outlook mailer too; check your plan, since its one click setup is Pro.
- Turn it back on, for now. Microsoft says an admin can turn password sending back on after December. It works only until the final removal date, and it keeps a password in your site. See Microsoft's post.
- A free relay. WP Mail SMTP's page lists Brevo with 300 free emails a day and SMTP2GO with 1,000 a month. Check their own pricing pages. A plugin that speaks plain SMTP can switch to one with no code. You will need to add SPF and DKIM records to your domain, or mail may land in spam.
- Microsoft's own guide. Authenticate an IMAP, POP or SMTP connection using OAuth, for whoever looks after your code.
Send us the ones these do not cover: custom PHP or script code, a plugin with no Microsoft mode, or app registration steps you want spelled out.
Free tool: a Graph sendMail example with tests on GitHub (MIT), if you want to do it yourself.
What you get back
- For code: new code that sends through Microsoft Graph with OAuth, or through a free relay, plus a local test.
- For a plugin: the exact settings to switch to its Microsoft mode or a relay.
- Step by step setup: how to make the app registration in your own Microsoft 365, and how to limit it to the one mailbox that sends.
Your form's visitors never choose who the mail goes to. The new code takes the sender and recipient from your settings only.
The limits, in plain words
- Tested with fake calls, no real tenant. Our examples passed their tests against fake copies of Microsoft's and Brevo's services, built from their docs. You still need one real test send in your own Microsoft 365.
- The secret expires. The new setup uses a client secret on your web server instead of a password. You pick when it expires, and the form stops again on that day unless you make a new one. We tell you how.
- Limiting it to one mailbox takes an admin. By default the app could send as anyone in your company. Narrowing it needs Exchange admin PowerShell. We write the steps.
- A relay needs DNS. If you cannot edit your domain's DNS records, a relay may land in spam.
- WordPress is setup, not code. For a plugin, the $49 buys clear steps, not a magic script.
- You make the accounts. We send code and steps. We never log in to anything of yours.
Price
Start before the end of December, while the old setup still sends.
-
Step 1
Free
Send one form or script
Email the code or a picture of the plugin's settings screen, subject "SMTP move". Hide every password first.
-
Step 2
Free
Get the free check
We tell you which fix fits, and if a free one does, we say so. We reply usually within 2 business days.
-
Step 3
$49 once
We move it
One form or script, with a test and setup steps. Pay with the email you used. No subscription.
Questions
What if you cannot move it?
We tell you before you pay. If we cannot move it, we refund the $49 in full. Terms.
Can I just turn it back on?
For now, yes, Microsoft says admins can. It still ends once Microsoft names the final date, and your site keeps holding a password until then.
Do you need my password?
No. Hide every password and secret before you send anything. We never ask for passwords, secrets or access to your Microsoft 365.
Who does the work?
Tack, our AI personality, writes the new code, its test and the setup steps.
Are you part of Microsoft?
No. Brasspage is an independent studio. We only help you move.