535 5.7.139 Authentication unsuccessful: SmtpClientAuthentication is disabled

535 5.7.139 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Tenant.
535 5.7.139 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Mailbox.
535 5.7.139 Authentication unsuccessful, basic authentication is disabled.

What the message means

Devices that send through smtp.office365.com with a mailbox's username and password use what Microsoft calls SMTP AUTH (authenticated client SMTP submission). Microsoft 365 has a switch for it at two levels: the whole organization, and each mailbox. “SmtpClientAuthentication is disabled” means that switch is off for the level named at the end of the message.

Microsoft's documentation says SMTP AUTH is disabled for organizations created after January 2020 unless it is enabled per mailbox, and “If security defaults is enabled in your organization, SMTP AUTH is already disabled in Exchange Online. To use SMTP AUTH, you need to disable security defaults.”

Sources: Microsoft Learn, Enable or disable authenticated client SMTP submission (SMTP AUTH) in Exchange Online; Microsoft Learn, How to set up a multifunction device or application to send email using Microsoft 365 or Office 365 (read October 30, 2026)

“…disabled for the Tenant”

The organization-wide setting is off. You don't need to turn it on for everyone: the mailbox setting takes precedence over the organization setting, and Microsoft recommends keeping SMTP AUTH off for the organization and on only for the mailboxes that need it.

Turn it on for the one mailbox the device uses

1. Open the Microsoft 365 admin center and go to Users > Active users.
2. Select the user (the mailbox the device sends as), and in the flyout select Mail.
3. In the Email apps section, select Manage email apps.
4. Check Authenticated SMTP, then select Save changes.

Or in Exchange Online PowerShell:

Set-CASMailbox -Identity scanner@example.com -SmtpClientAuthenticationDisabled $false

Or for the whole organization

Set-TransportConfig -SmtpClientAuthenticationDisabled $false

Full steps, and the cases where turning it on doesn't help, are on how to enable SMTP AUTH in Office 365.

Source: Microsoft Learn, Enable or disable authenticated client SMTP submission (SMTP AUTH) in Exchange Online (read October 30, 2026)

“…disabled for the Mailbox”

Authenticated SMTP is off for the mailbox the device signs in as. Microsoft's troubleshooting article gives the PowerShell check: if the value is True, it's off.

Get-CASMailbox -Identity scanner@example.com | Format-List SmtpClientAuthenticationDisabled
Set-CASMailbox -Identity scanner@example.com -SmtpClientAuthenticationDisabled $false

Or use the admin center steps above.

Source: Microsoft Learn, Fix issues with printers, scanners, and LOB apps that send email using Microsoft 365 (read October 30, 2026)

“…basic authentication is disabled”

Here SMTP AUTH itself may be on, but signing in with a password is blocked. Microsoft's SMTP AUTH article: “If your authentication policy disables basic authentication for SMTP, clients cannot use the SMTP AUTH protocol even if you enable the settings outlined in this article.”

Security defaults in Microsoft Entra ID block it too: “After security defaults are enabled in your tenant, all authentication requests made by an older protocol will be blocked.”

Sources: Microsoft Learn, Enable or disable authenticated client SMTP submission (SMTP AUTH) in Exchange Online; Microsoft Learn, Security defaults in Microsoft Entra ID; Microsoft 365 Message Center notice MC786329 (updated January 27, 2026) (read October 30, 2026)

The federated sign-in versions

Two more versions appear in organizations that sign in through their own federation servers:

535 5.7.139 Authentication unsuccessful, federated STS service was unreachable.
535 5.7.139 Authentication unsuccessful, the federated STS URL does not support HTTPS.

Microsoft's troubleshooting article ties both to federation gateway servers hosted on-premises: the first means Microsoft couldn't reach the server, the second that it couldn't set up a secure connection to it. For the second, Microsoft says to make sure your servers can use TLS 1.2.

Source: Microsoft Learn, Fix issues with printers, scanners, and LOB apps that send email using Microsoft 365 (read October 30, 2026)

Fixes that last past December 2026

Turning SMTP AUTH on clears the cause the “Tenant” and “Mailbox” versions name, for a device that signs in with a password. That password sign-in is what the notice turns off by default at the end of December 2026. These routes don't depend on it:

• OAuth on the device. “SMTP AUTH supports modern authentication (Modern Auth) through OAuth in addition to basic authentication.” If your copier's maker supports it on your model, it's the route Microsoft recommends. See the guide and your brand's page.
• An SMTP relay connector. The device sends to your MX endpoint on port 25 and Microsoft 365 recognises it by your static IP address or a certificate. Steps.
• Direct Send or High Volume Email, if scans only go to people inside your organization. Details.
• A third-party relay, which Microsoft's notice names as one way forward: “if you must use Basic auth to send email with Exchange Online, then you must use one of the alternatives or a 3P solution.”

One thing to know: CopierBridge sends through Microsoft's SMTP with OAuth, so the mailbox still needs Authenticated SMTP on. Turn it on for that one mailbox as shown above; the device itself never signs in to Microsoft.

Common questions

Seeing 535 5.7.3 Authentication unsuccessful or 5.7.57 Client not authenticated to send mail instead? Those have their own pages.