v1.2.0 — tools for the December 2026 SMTP AUTH shutdown

[msgwing]

Microsoft disables Basic authentication for SMTP AUTH by default at the end of December 2026, and will announce the final removal date in the second half of 2027. v1.2.0 is about the parts of that problem which are not "point the device somewhere else".

Three things you can act on

Find out what breaks. Find-SmtpAuthExposure.ps1 reports every mailbox in your tenant that can still authenticate with SMTP AUTH. Read-only, so it is safe against production before you have decided anything.

It exists because the advice everyone repeats is wrong. SmtpClientAuthenticationDisabled is tri-state, and $null means inherit the tenant setting. Filtering on -eq $false — which is what the usual one-liner does — silently misses every inherited mailbox, so on a tenant nobody has locked down it can report zero while every mailbox is exposed.

Check whether your hardware has a way out. The compatibility list is machine-readable and every entry links to the vendor's own statement — the build refuses an entry without evidence. Konica Minolta marks a set of ineo models "N/A" in their own OAuth column and points those owners at a different mail service rather than an update; those are collected here.

If a firmware update exists for your model, apply it. That is the better answer and the decision guide now says so before it mentions anything else.

What I would like help with

Five issues are open with good first issue, and one matters more than the rest: #102 — add a hardware-confirmed device report.

Vendors publish headline model lists. Firmware branches, regional model names and OEM rebadges diverge from them, and the only way to know is to have configured the thing. If you have pointed a printer, NAS or backup tool at this and found something the datasheet did not tell you, that is worth more here than anything I can write.

The others: an Ansible playbook, a Docker Compose example, Zig, and a German translation — that last one only if you speak it natively, since a machine translation of a page somebody reads mid-outage is worse than none.

Thanks

@slegarraga contributed the Elixir, Lua and Dart examples, and @kevinbytnar reported the Canon Maxify MB2755 certificate quirk — a hardware-confirmed finding no datasheet would have produced.

[slegarraga]

Thank you for the credit, and congrats on shipping v1.2.0 — the tri-state SmtpClientAuthenticationDisabled explanation in Find-SmtpAuthExposure.ps1 alone justifies the release. Writing the Elixir, Lua and Dart examples was genuinely fun; if more runtimes would help as the December 2026 deadline approaches, happy to add them.