App passwords still behave like reusable secrets
An app password avoids an interactive second factor in the client. It does not give an old SMTP device a modern OAuth flow, scoped access token, or independent consent lifecycle.
Microsoft has removed this path in important configurations
Microsoft documents that Basic authentication deprecation prevents app-password use for affected Exchange Online clients. Security Defaults and tenant policy can also make Basic-authenticated client SMTP unsuitable or unavailable.
Choose a supported replacement
Update the client to OAuth, integrate Graph, use an appropriate Microsoft sending service or relay design, or use a focused bridge where standard authenticated SMTP is the only interface.