Exchange Online - SMTP Relay for Onpremise Systems

Hi, @SQIT

With the imminent retirement of legacy SMTP protocols, including SMTP authentication, you will need to look for alternative ways to enable your on-premises systems to continue sending email securely. Here are some suggestions that may help:

1. You can configure your local system to use Office 365's SMTP trunk. This method allows you to send emails without using SMTP authentication.
2. For clients that still require legacy SMTP, you can opt in to Exchange Online endpoints to support legacy TLS clients that use SMTP AUTH.
3. If you have a hybrid setup of on-premises and cloud environments, you can take advantage of a hybrid configuration where email is routed through an on-premises Exchange server and then relayed by it to Office 365.
4. If you have any systems that can be updated or configured to use OAuth2, this should be your top consideration for modern and secure email communications.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Your follow-up question is the right one, and it deserves a straight answer: the four options above assume either a client that can do OAuth, or an on-premises Exchange server to relay through. If you have neither, none of them fit, and that gap is real rather than something you have overlooked.

What closes it is a small SMTP relay of your own that sits between the two worlds. The devices keep speaking plain SMTP to a box on your LAN, and that box does the OAuth2 handshake and hands the message to Microsoft Graph or to SMTP AUTH with a token. Functionally it is the hybrid Exchange answer with the Exchange server taken out: same local SMTP endpoint, same authenticated modern connection going out, without a server to licence, patch and keep in a supported version.

Compared with the connector relay it also buys back the things you lose there:

• Each device can authenticate to the relay with its own SMTP credentials, so you can tell in the log which one sent what.
• No static public IP needed, and outbound port 25 stays closed. The relay talks HTTPS to Graph.
• The From address is a real mailbox, because the relay posts to /users/{mailbox}/sendMail. Restrict which mailboxes with New-ApplicationAccessPolicy, otherwise the app registration can send as anyone in the tenant.
• The credentials sit in one place you control instead of in thirty device web interfaces.

On the two options that were suggested to you: High Volume Email is for recipients inside your own organisation, so it does not help if the scanners mail to customers. Azure Communication Services Email is a separate service with its own sender domain and its own reputation to build, and it usually means touching the sending application, which is exactly what you cannot do.

For the relay itself there are open-source projects on GitHub and commercial products. Disclosure: I develop one of the commercial ones, SMTPly (https://smtply.app) — a Windows service, everything stays on your server, no telemetry, signed installer, 149 EUR once per server and a 14-day trial. If your environment does have a static public IP and the devices only need to reach external recipients, the connector relay in the earlier answer is free and worth trying first.

Hi Xintao Qiao,

many thanks for your Reply.

so the only secure ways would be option 3 or 4.

In conclusion, either we use the Hybrid setup (relay over onprem Exchange) or we use OAuth if possible. Is there anything planed for Environments who dont support OAuth if no Onprem Exchange is available as SMTP is soon decommissioned? I Guess the Option 1 with the Exchange Connector is not the best choice as it doesnt need any authentication.

Best Regards