Before disabling SMTP AUTH tenant-wide, identify legitimate dependencies.
Microsoft exposes an SMTP AUTH Clients report in the Exchange admin center that can help identify accounts using the protocol and show related TLS usage.
For each dependency, record the application owner, account, source, authentication method, recipients and replacement plan.
Reduce the exception set
If SMTP AUTH remains necessary, prefer a narrow per-mailbox exception instead of enabling it everywhere. Protect the identity and migrate legacy password-based integrations where supported.