Find-SmtpAuthExposure

Answers one question before December 2026: which mailboxes in this tenant
can still send with a username and password, and will therefore stop when
Microsoft disables SMTP AUTH Basic authentication by default at the end of
that month. Printers, scanners, MFPs, NAS units and scripts are what break,
and the error they will report is 535 5.7.139.

Read-only. The script queries configuration and prints a report; it never
changes a setting, so it is safe to run against production before you have
decided anything.

The reason a script is needed rather than one Get-CASMailbox call is that
SmtpClientAuthenticationDisabled is tri-state, and the middle state is the
one that catches people out:

   $true   SMTP AUTH explicitly blocked for this mailbox
   $false  SMTP AUTH explicitly allowed for this mailbox
   $null   inherit the tenant-wide setting

A mailbox showing $null looks harmless in a spreadsheet and is in fact
fully exposed whenever the tenant allows SMTP AUTH. Filtering only on
`-eq $false`, which is the usual advice, silently misses every one of them.