Keep scan to email working after Microsoft 365 turns off basic SMTP AUTH.
Copiers, scanners and business apps send email to Microsoft 365 with a username and password. At the end of December 2026 Microsoft disables that by default. CopierBridge takes the same kind of login from your device and sends each message through your own mailbox with Microsoft's approved sign-in.
$9 a device a month. Your first device is free for 14 days.
- SMTP server
- smtp.copierbridge.com
- Port
- 587
- Encryption
- STARTTLS
- Authentication
- On (username and password)
- Username
- frontdesk-copier
- Password
- ••••••••••••••••
- From address
- scans@example.com
What changes
The date that matters is the end of December 2026
Microsoft's Message Center notice MC786329 (updated January 27, 2026) sets the timeline. Anything that sends through Microsoft 365 with a mailbox password is affected: scan to email on copiers and scanners, accounting and line-of-business apps, and any other equipment set up with smtp.office365.com.
- NowBasic SMTP AUTH still works where it is onAdmins can still turn it back on for now. Devices that sign in to Microsoft 365 with a password keep sending.
- End of December 2026Turned off by default for existing tenantsScan to email that signs in with a mailbox password stops unless an admin turns it back on. Tenants created after December 2026 won't have it at all.
- Second half of 2027Microsoft announces the final removal dateAfter that date, turning it back on won't be an option. Plan the move before then.
Source: Microsoft 365 Message Center notice MC786329 (updated January 27, 2026). Microsoft's advice for anything that must keep a username and password: if you must use Basic auth to send email with Exchange Online, then you must use one of the alternatives or a 3P solution
.
How it works
Four steps, and the copier never learns anything new
Your devices keep doing what they do today. The part that changes happens between us and Microsoft.
- 01
Turn on Authenticated SMTP
An admin ticks Authenticated SMTP for the mailbox the device sends as, in the Microsoft 365 admin center. Microsoft's steps.
- 02
Connect the mailbox
Sign in with Microsoft as the mailbox the device should send from. The mailbox owner approves sending only as that mailbox. We never ask to read it.
- 03
Add a device
Name it (front desk copier, warehouse scanner) and we create a username and password for that device alone.
- 04
Type four values into the copier
Server, port, username and password, in the device's scan-to-email settings. Send a test scan. That's the whole setup.
Copier, scanner or app
Keeps its SMTP settings: a host, a port, a username and a password.
or 465 TLS
Checks the device's own login
Each device has its own credentials. Messages are passed on, not stored.
send only, one mailbox
Your own mailbox sends it
The mailbox you connected, with Microsoft's approved sign-in.
Your options
Microsoft offers several routes. Most have a catch for copiers.
If your device can sign in with OAuth, use that. If not, here is what each route asks of you, from Microsoft's own setup article. The guide walks through every one.
| Route | Sends outside your organization | Port | What you need |
|---|---|---|---|
| OAuth on the deviceClient SMTP submission with modern authentication | Yes | 587 | A device and firmware that support OAuth, and a licensed mailbox |
| Basic SMTP AUTH, turned back onA stopgap until the final removal date | Yes | 587 | An admin re-enables it; security defaults off |
| SMTP relay (connector)Your devices send to your MX endpoint | Yes | 25 | A static IP not shared with another organization, or a certificate |
| Direct SendUnauthenticated, straight to your MX endpoint | No | 25 | A From address in your domain; SPF, DKIM and DMARC |
| High Volume EmailDedicated HVE accounts, no mailbox | No | 587 | An HVE account with a pay-as-you-go billing policy |
| On-premises Exchange relayIf you still run Exchange Server | Through your server | 25 | An Exchange server and a dedicated Receive connector |
| Third-party relayFor example, CopierBridge | Yes | 587 or 465 | A subscription, and Authenticated SMTP on for the mailbox |
Sources: Microsoft Learn, How to set up a multifunction device or application to send email using Microsoft 365 or Office 365; Manage High Volume Email for Microsoft 365; Allow anonymous relay on Exchange servers. Read October 30, 2026.
By brand
Setup notes for the copiers in most offices
Where the scan-to-email settings live, what the maker says about Microsoft 365, and what to type.
What we hold
The narrowest access that does the job
We ask Microsoft for permission to send as the one mailbox you connect, and nothing that lets us read it.
- Send-only permission. Microsoft's permission to send mail as the connected mailbox, and nothing that can read it.
- One login per device. Revoke a single copier's password without touching the others.
- No stored messages. Each message is handed to Microsoft and not kept. Message contents are never logged.
- Encrypted connections. Port 587 with STARTTLS or port 465 with TLS from the device, and an encrypted connection from us to Microsoft.
- Mailbox tokens encrypted at rest. Disconnect a mailbox and its tokens are deleted.
Pricing
$9 a device a month
Your first device is free for 14 days. One price, whatever the device: a copier, a scanner or an app.
Common questions
Will our copier stop sending scans?
If it signs in to smtp.office365.com with a mailbox's username and password, it uses SMTP AUTH with basic authentication, which is what the notice turns off by default at the end of December 2026. Unless an admin turns it back on, scan to email from that device will fail.
Can we just turn basic authentication back on?
For now, yes. The notice says admins can still re-enable it, per mailbox (the Authenticated SMTP setting in the Microsoft 365 admin center) or for the whole organization. It's a stopgap: Microsoft will announce the final removal date in the second half of 2027.
What access do you need to our Microsoft 365?
Permission to send mail as the one mailbox you connect. The mailbox owner approves it at Microsoft's own sign-in page. Nothing we hold can read the mailbox.
Does anything need to change in our Microsoft 365?
One setting: Authenticated SMTP has to be on for the mailbox the device sends as. An admin turns it on per mailbox in the Microsoft 365 admin center (Users > Active users, select the user, Mail, Manage email apps, then check Authenticated SMTP and save).
Get your devices sorted before the end of December
Point each device at us once, and scan to email keeps working after Microsoft's switch. Your first device is free for 14 days.
Sign in with your Microsoft 365 work account, connect the mailbox your devices send as, and add your first device.