diff --git a/internal/provider/fake/fake.go b/internal/provider/fake/fake.go
index 9c9fc0a..618835d 100644
--- a/internal/provider/fake/fake.go
+++ b/internal/provider/fake/fake.go
@@ -350,7 +350,7 @@ func Azure(delay time.Duration) *Provider {
 		Name: "env-share", Enabled: &yes, Updated: base, Reference: secretRef("kv-shared-prod", "env-share"),
 	}, "q8Zt3VwL1mXc7Rk2Pj9Ys4Hn6Bf0Ga5Ud+Te/OiWlE=")
 	p.add(shared, provider.TypeSecret, provider.Object{
-		Name: "smtp-password", Enabled: &yes, Updated: base, Reference: secretRef("kv-shared-prod", "smtp-password"),
+		Name: "smtp-password", Enabled: &no, Updated: base, Reference: secretRef("kv-shared-prod", "smtp-password"),
 	}, "smtp-demo-password")
 	p.fail(shared, ErrForbiddenKeys, provider.TypeKey)
 
@@ -397,7 +397,7 @@ func AzureOps(delay time.Duration) *Provider {
 	}, "break-glass-demo-password")
 	shared := p.addContainer(prod, "kv-shared-prod", "https://kv-shared-prod.vault.azure.net", allTypes...)
 	p.add(shared, provider.TypeSecret, provider.Object{
-		Name: "smtp-password", Enabled: &yes, Updated: base, Reference: secretRef("kv-shared-prod", "smtp-password"),
+		Name: "smtp-password", Enabled: &no, Updated: base, Reference: secretRef("kv-shared-prod", "smtp-password"),
 	}, "smtp-demo-password")
 	// Unlike the first account, ops may read keys here.
 	p.add(shared, provider.TypeKey, provider.Object{
diff --git a/internal/provider/fake/seed.go b/internal/provider/fake/seed.go
index 406d377..25af2b4 100644
--- a/internal/provider/fake/seed.go
+++ b/internal/provider/fake/seed.go
@@ -31,7 +31,8 @@ func Seed(st *store.Store, alice, admin string) {
 		{link: azure + "kv-breakglass.vault.azure.net/secrets/emergency-admin", account: admin, source: "sub-prod",
 			path: []string{"platform-prod", "kv-breakglass"}, star: true, note: "incidents only: tell #ops when used"},
 		{link: azure + "kv-shared-prod.vault.azure.net/secrets/smtp-password", account: alice, source: "sub-prod",
-			path: []string{"platform-prod", "kv-shared-prod"}, uses: 2, ago: 26 * time.Hour},
+			path: []string{"platform-prod", "kv-shared-prod"}, uses: 2, ago: 26 * time.Hour,
+			note: "migrated to Microsoft Graph sendMail; disabled, delete after Q4"},
 		{link: dbx + "app/storage-key", account: "Databricks", source: "dbx-prod",
 			path: []string{"prod", "app"}, star: true, uses: 3, ago: 5 * time.Hour},
 		// A subscription, for both accounts, and a repo's file.