Mailboxes that can still use SMTP AUTH

#Requires -Modules ExchangeOnlineManagement
# Mailboxes whose effective SMTP AUTH setting is enabled (mailbox value, else the organisation value). Read-only.
param(
    [switch]$All
)

Connect-ExchangeOnline -ShowBanner:$false

$orgDisabled = [bool](Get-TransportConfig).SmtpClientAuthenticationDisabled
Write-Output "Organisation SmtpClientAuthenticationDisabled = $orgDisabled"

Get-EXOCasMailbox -ResultSize Unlimited -Properties SmtpClientAuthenticationDisabled |
    ForEach-Object {
        $mailboxValue = $_.SmtpClientAuthenticationDisabled
        $disabled = if ($null -eq $mailboxValue) { $orgDisabled } else { [bool]$mailboxValue }
        [pscustomobject]@{
            Mailbox         = "$($_.PrimarySmtpAddress)"
            MailboxSetting  = if ($null -eq $mailboxValue) { 'Follows organisation' } else { "$mailboxValue" }
            SmtpAuthEnabled = -not $disabled
        }
    } |
    Where-Object { $All -or $_.SmtpAuthEnabled } |
    Sort-Object Mailbox

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Reading the output

• Per Microsoft, a mailbox's SmtpClientAuthenticationDisabled value ($true or $false) overrides the organisation setting, and $null means the mailbox follows the organisation. The script works out the effective value for each mailbox.
• If security defaults are enabled, Microsoft says SMTP AUTH is already disabled in Exchange Online, whatever these settings say.
• SMTP AUTH is what printers, scanners and older apps use to send mail. Each mailbox listed should be one that really needs it.
• Pass -All to list every mailbox with its setting.
• ExchangeOnlineManagement 3.10.0 and later require PowerShell 7.6 when run in PowerShell 7 (Windows PowerShell 5.1 is unaffected), per the module release notes.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.