535 5.7.3 Authentication unsuccessful

535 5.7.3 Authentication unsuccessful

What the error means

The device or app tried to sign in to Microsoft 365 and was turned away. Microsoft's troubleshooting article for printers, scanners and line-of-business apps files this error under Error: Authentication unsuccessful, together with 5.7.57 Client not authenticated to send mail.

Start with the obvious: the username on the device is the full email address of a licensed mailbox, and the password is that mailbox's current password. If both are right, work through Microsoft's checks below.

The same text also comes from Exchange Server running on site. This page covers Microsoft 365 (Exchange Online).

Microsoft's four checks

Microsoft's article says to check these, in this order:

1. SMTP AUTH is enabled on the mailbox

“Use Exchange Online PowerShell to verify that authenticated SMTP submission (also known as SMTP AUTH) is enabled on the licensed mailbox that the printer or application is using to connect to Microsoft 365 or Office 365.” If the first command returns True, the second turns it on:

Get-CASMailbox -Identity <EmailAddress> | Format-List SmtpClientAuthenticationDisabled
Set-CASMailbox -Identity <EmailAddress> -SmtpClientAuthenticationDisabled $false

The admin center way, and when turning it on isn't enough, is on how to enable SMTP AUTH.

2. Multifactor authentication on that mailbox

Microsoft's article says to disable multifactor authentication on the licensed mailbox the device uses:

1. In the Microsoft 365 admin center, in the left navigation menu, choose Users > Active users.
2. On the Active users page, choose Multi-Factor Authentication.
3. On the multi-factor authentication page, select the user and disable the multifactor authentication status.

3. Security defaults

1. Sign in to the Azure portal as a Security administrator or Conditional Access administrator.
2. Browse to Microsoft Entra ID > Properties.
3. Select Manage security defaults.
4. Set the Enable security defaults toggle to No.
5. Select Save.

4. A Conditional Access policy that blocks legacy authentication

Exclude the device's mailbox from that policy:

1. Browse to Microsoft Entra ID > Security > Conditional Access.
2. In the policy that blocks Legacy Authentication, exclude the mailbox being used under Users and Groups > Exclude.

Sources: Microsoft Learn, Fix issues with printers, scanners, and LOB apps that send email using Microsoft 365; Microsoft Learn, How to set up a multifunction device or application to send email using Microsoft 365 or Office 365 (read October 30, 2026)

Fixes that last past December 2026

Checks 2 to 4 relax protections so a password can still sign in, and password sign-in is what Microsoft's notice MC786329 turns off by default: “End of December 2026: SMTP AUTH Basic Authentication will be disabled by default for existing tenants.” These routes don't depend on it:

• OAuth on the device. SMTP AUTH supports OAuth as well as passwords, and it's the method Microsoft recommends. It works if your copier's maker supports it on your model and firmware: see the guide and your brand's page.
• An SMTP relay connector. The device sends to your MX endpoint on port 25, and Microsoft 365 recognises it by your static IP address or a certificate. Steps.
• Direct Send or High Volume Email, if scans only ever go to people inside your organization. Details.
• A third-party relay, which Microsoft's notice names for anything that must keep a username and password: “if you must use Basic auth to send email with Exchange Online, then you must use one of the alternatives or a 3P solution.”

Common questions