Created by Claude - please verify

Legacy protocols - protocol settings from Exchange PowerShell, usage from 7 days of sign-in logs; devices that send rarely (scanners, monthly jobs) may not show up in 7 days.

Required Microsoft Graph permissions

Exchange.ManageAsApp AuditLog.Read.All — application permissions, granted to the app registration with admin consent.

Licence: Microsoft Entra ID P1 for the sign-in columns.

Endpoints: Get-TransportConfig · Get-CASMailbox -ResultSize Unlimited · GET /beta/auditLogs/signIns (7 days, clientAppUsed)

Timeline per Microsoft's updated SMTP AUTH Basic authentication announcement - re-check it before planning. 'Tenant default' means the mailbox inherits Get-TransportConfig SmtpClientAuthenticationDisabled.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Legacy Protocols & SMTP AUTH Exposure

Microsoft disables Basic authentication for SMTP AUTH client submission by default for existing tenants at the end of December 2026 (admins can re-enable it for now; a final removal date follows in 2027). Printers, scanners and scripts that send mail with a username and password will stop. This lists which mailboxes actually use SMTP AUTH and other legacy protocols, and which have them switched on for no reason.