How to enable SMTP AUTH in Office 365

Check whether it's on

In Exchange Online PowerShell, for the mailbox the device signs in as:

Get-CASMailbox -Identity <EmailAddress> | Format-List SmtpClientAuthenticationDisabled

True means SMTP AUTH is disabled for that mailbox.

Microsoft's documentation says SMTP AUTH is disabled for organizations created after January 2020 unless it is enabled per mailbox.

Sources: Microsoft Learn, Fix issues with printers, scanners, and LOB apps that send email using Microsoft 365; Microsoft Learn, How to set up a multifunction device or application to send email using Microsoft 365 or Office 365 (read October 30, 2026)

Enable it for one mailbox

In the Microsoft 365 admin center

1. Open the Microsoft 365 admin center and go to Users > Active users.
2. Select the user (the mailbox the device sends as), and in the flyout select Mail.
3. In the Email apps section, select Manage email apps.
4. Check Authenticated SMTP, then select Save changes.

In Exchange Online PowerShell

Set-CASMailbox -Identity scanner@example.com -SmtpClientAuthenticationDisabled $false

Source: Microsoft Learn, Enable or disable authenticated client SMTP submission (SMTP AUTH) in Exchange Online (read October 30, 2026)

Enable it for the whole organization

In the Exchange admin center, the Mail flow settings page has a toggle labelled Turn off SMTP AUTH protocol for your organization. In PowerShell, to turn it on:

Set-TransportConfig -SmtpClientAuthenticationDisabled $false

Source: Microsoft Learn, Enable or disable authenticated client SMTP submission (SMTP AUTH) in Exchange Online (read October 30, 2026)

Which one to use

One mailbox. Microsoft recommends keeping SMTP AUTH off for the organization and enabling it only for the mailboxes that still need it, and the mailbox setting takes precedence over the organization setting. So a device's mailbox can send even while the organization setting stays off.

When turning it on isn't enough

• Security defaults. “If security defaults is enabled in your organization, SMTP AUTH is already disabled in Exchange Online. To use SMTP AUTH, you need to disable security defaults.”
• An authentication policy. “If your authentication policy disables basic authentication for SMTP, clients cannot use the SMTP AUTH protocol even if you enable the settings outlined in this article.”
• Multifactor authentication, or a Conditional Access policy that blocks legacy authentication, on a device that signs in with a password. Microsoft's steps: its four checks.

The errors these produce are on 535 5.7.139, 535 5.7.3 and 5.7.57.

Sources: Microsoft Learn, Enable or disable authenticated client SMTP submission (SMTP AUTH) in Exchange Online; Microsoft Learn, Fix issues with printers, scanners, and LOB apps that send email using Microsoft 365 (read October 30, 2026)

OAuth devices need it too

SMTP AUTH is the protocol, not the password: “SMTP AUTH supports modern authentication (Modern Auth) through OAuth in addition to basic authentication.” A device that signs in with OAuth still sends over SMTP AUTH. Epson's setup page for OAuth says it plainly: “You must also enable SMTP AUTH in Exchange Online.” CopierBridge, which sends with OAuth, needs it on for the mailbox it sends as, too.

Sources: Epson, Registering an Email Server; Microsoft Learn, Enable or disable authenticated client SMTP submission (SMTP AUTH) in Exchange Online (read October 30, 2026)

After December 2026

Microsoft's notice MC786329: “End of December 2026: SMTP AUTH Basic Authentication will be disabled by default for existing tenants.” Admins can still turn it back on for now, and Microsoft will announce the final removal date in the second half of 2027 (what that means in practice). For a device that signs in with a password, these routes last longer:

• OAuth on the device. SMTP AUTH supports OAuth as well as passwords, and it's the method Microsoft recommends. It works if your copier's maker supports it on your model and firmware: see the guide and your brand's page.
• An SMTP relay connector. The device sends to your MX endpoint on port 25, and Microsoft 365 recognises it by your static IP address or a certificate. Steps.
• Direct Send or High Volume Email, if scans only ever go to people inside your organization. Details.
• A third-party relay, which Microsoft's notice names for anything that must keep a username and password: “if you must use Basic auth to send email with Exchange Online, then you must use one of the alternatives or a 3P solution.”

Common questions