Questions about the SMTP AUTH change

Microsoft's Message Center notice MC786329 says: “End of December 2026: SMTP AUTH Basic Authentication will be disabled by default for existing tenants.” Tenants created after December 2026 won't have it by default.

Admins can still turn it back on for now. Microsoft will announce the final removal date in the second half of 2027.

If it signs in to smtp.office365.com with a mailbox's username and password, it uses SMTP AUTH with basic authentication, which is what the notice turns off by default at the end of December 2026. Unless an admin turns it back on, scan to email from that device will fail.

If the device signs in with OAuth (often labelled modern authentication or Microsoft 365 sign-in), or sends to your MX endpoint on port 25 through Direct Send or an SMTP relay connector, this change is not about it.

Open the device's email or SMTP settings, usually on its built-in web page (type the device's IP address into a browser and sign in as the administrator). If the server is smtp.office365.com, the port is 587 or 25, and there is a username and password, the device uses SMTP AUTH.

For now, yes. The notice says admins can still re-enable it, per mailbox (the Authenticated SMTP setting in the Microsoft 365 admin center) or for the whole organization. It's a stopgap: Microsoft will announce the final removal date in the second half of 2027.

It won't work while security defaults are on in Microsoft Entra ID, or while an authentication policy blocks basic authentication for SMTP.

Not with client SMTP submission, according to Microsoft: “If your device or application recommends or defaults to TCP port 465, it doesn't support the required versions of TLS for client SMTP submission in Microsoft 365 or Office 365.”

CopierBridge accepts connections on port 465 with TLS as well as on port 587 with STARTTLS.

The notice is about SMTP AUTH with basic authentication. Direct Send uses no authentication, and an SMTP relay connector authenticates your devices by a certificate or your static IP address.

Microsoft's setup article does say, about Direct Send: “We're working on an option to disable Direct Send by default to protect customers.”

It accepts the old kind of login from copiers, scanners and apps (SMTP with a username and password, on port 587 or 465) and sends each message from your own Microsoft 365 mailbox through Microsoft's own mail service, signed in with Microsoft's approved method (OAuth) and permission to send only.

Microsoft's notice names a third-party solution as one of the ways forward for anything that must keep using a username and password.

Permission to send mail as the one mailbox you connect. The mailbox owner approves it at Microsoft's own sign-in page. Nothing we hold can read the mailbox.

One setting: Authenticated SMTP has to be on for the mailbox the device sends as. An admin turns it on per mailbox in the Microsoft 365 admin center (Users > Active users, select the user, Mail, Manage email apps, then check Authenticated SMTP and save).

Microsoft recommends keeping SMTP AUTH off for the organization and on only for the mailboxes that need it. The mailbox setting takes precedence over the organization setting.

No. Each message is passed to Microsoft and not kept. We don't log message contents.

The CopierBridge server name, port 587 with STARTTLS (or 465 with TLS), and the username and password we create for that device. The From address is the mailbox you connected.

$9 a device a month. Your first device is free for 14 days.

No. If your model and firmware can sign in to Microsoft 365 with OAuth, that's the route Microsoft recommends. CopierBridge is for the devices and apps that can't.

No. It's an independent service that works with Microsoft 365. It isn't affiliated with or endorsed by Microsoft.

Look it up on Microsoft 365 SMTP errors: 535 5.7.139 (SmtpClientAuthentication is disabled), 535 5.7.3 Authentication unsuccessful, 5.7.57 Client not authenticated to send mail and Ricoh's “Authentication with the destination has failed”. No message? Start with scan to email not working or smtp.office365.com not working.