530 5.7.57 Client not authenticated to send mail

530 5.7.57 Client not authenticated to send mail
5.7.57 Client not authenticated to send mail
Client was not authenticated to send anonymous mail during MAIL FROM

What the error means

Sending through smtp.office365.com is what Microsoft calls client SMTP submission (SMTP AUTH): the device has to sign in as a licensed mailbox before Microsoft 365 takes a message. This error means it didn't, for one of the reasons below.

The device didn't sign in

“This error indicates that your printer connects to the SMTP client submission endpoint (smtp.office365.com). However, your printer must also logon to a mailbox to send a message. This error occurs when you haven't entered mailbox logon credentials in the printer's settings.”Microsoft Learn, troubleshooting printers, scanners and LOB apps

Open the device's email or SMTP settings (usually its built-in web page: type its IP address into a browser and sign in as the administrator), turn on SMTP authentication, and enter the mailbox's full email address and password.

And if there's nowhere to enter them, Microsoft says: “If there's no option to enter credentials, this printer doesn't support SMTP client submission; use either direct send or Microsoft 365 or Office 365 SMTP relay instead.”

The sign-in was refused

If a username and password are set, Microsoft's article lists 5.7.57 Client not authenticated to send mail with 535 5.7.3 Authentication unsuccessful and gives the same four checks for both:

1. SMTP AUTH is enabled on the licensed mailbox the device uses.
2. Multifactor authentication on that mailbox.
3. Security defaults in Microsoft Entra ID.
4. A Conditional Access policy that blocks legacy authentication.

Each one, with Microsoft's exact steps and cautions, is on 535 5.7.3: Microsoft's four checks. The first one, in Exchange Online PowerShell:

Get-CASMailbox -Identity <EmailAddress> | Format-List SmtpClientAuthenticationDisabled
Set-CASMailbox -Identity <EmailAddress> -SmtpClientAuthenticationDisabled $false

You meant to use Direct Send

Direct Send needs no sign-in, but it doesn't go to smtp.office365.com: “This indicates that you're connecting to the SMTP client submission endpoint (smtp.office365.com), which can't be used for direct send.” Point the device at your organization's MX endpoint instead, which ends with mail.protection.outlook.com, on port 25.

Direct Send can't deliver to recipients outside your organization. The guide's Direct Send section has the full setup.

Sources: Microsoft Learn, Fix issues with printers, scanners, and LOB apps that send email using Microsoft 365; Microsoft Learn, How to set up a multifunction device or application to send email using Microsoft 365 or Office 365 (read October 30, 2026)

Fixes that last past December 2026

A device that signs in with a mailbox password will need a new route soon: “End of December 2026: SMTP AUTH Basic Authentication will be disabled by default for existing tenants.” These routes don't depend on password sign-in:

• OAuth on the device. SMTP AUTH supports OAuth as well as passwords, and it's the method Microsoft recommends. It works if your copier's maker supports it on your model and firmware: see the guide and your brand's page.
• An SMTP relay connector. The device sends to your MX endpoint on port 25, and Microsoft 365 recognises it by your static IP address or a certificate. Steps.
• Direct Send or High Volume Email, if scans only ever go to people inside your organization. Details.
• A third-party relay, which Microsoft's notice names for anything that must keep a username and password: “if you must use Basic auth to send email with Exchange Online, then you must use one of the alternatives or a 3P solution.”

Common questions