Scan to email not working with Microsoft 365

Start with what the device shows

Look for the message on the device's screen or in its send history (a Ricoh, for example, points you to [Scanned Files Status]). Find it here:

No message, or a timeout? Go to TLS and ports.

Check four settings

Open the device's email or SMTP settings, usually on its built-in web page: type the device's IP address into a browser on the same network and sign in as the administrator. For Microsoft 365 with a username and password, they should be:

Server

smtp.office365.com

Port

587 (recommended) or 25

Encryption

TLS or STARTTLS on, TLS 1.2 or TLS 1.3

Username and password

The sign-in of a licensed mailbox: its full email address and its password

If the device only offers port 465, Microsoft says: “If your device or application recommends or defaults to TCP port 465, it doesn't support the required versions of TLS for client SMTP submission in Microsoft 365 or Office 365.” Full settings: Office 365 SMTP settings.

Source: Microsoft Learn, How to set up a multifunction device or application to send email using Microsoft 365 or Office 365 (read October 30, 2026)

SMTP AUTH is turned off

Microsoft 365 has a switch for this kind of sign-in, for the whole organization and for each mailbox. Microsoft's documentation says it's disabled for organizations created after January 2020 unless it is enabled per mailbox, and “If security defaults is enabled in your organization, SMTP AUTH is already disabled in Exchange Online. To use SMTP AUTH, you need to disable security defaults.” Devices and apps report it as 535 5.7.139 … SmtpClientAuthentication is disabled. To turn it on for the one mailbox the device uses: how to enable SMTP AUTH.

The sign-in is refused

For 535 5.7.3 Authentication unsuccessful and 5.7.57 Client not authenticated to send mail, Microsoft's troubleshooting article lists four checks: SMTP AUTH on the mailbox, multifactor authentication on it, security defaults, and a Conditional Access policy that blocks legacy authentication.

The device can't do TLS 1.2

“Recently, we started rejecting a percentage of connections to smtp.office365.com that uses TLS1.0/1.1 for SMTP AUTH. Your device must support TLS version 1.2 or above.”Microsoft Learn, troubleshooting printers, scanners and LOB apps

Microsoft's advice is to update the device's firmware or use a route where TLS is optional. Admins who must keep TLS 1.0 or 1.1 devices can opt in, and those devices then send to a separate endpoint, smtp-legacy.office365.com.

Port 587 or 25 is blocked

“If you can't connect to Microsoft 365 or Office 365, your network firewall or Internet Service Provider (ISP) might have blocked port 587 or 25.” Ask whoever runs the network or the internet line whether outbound 587 is allowed from the device.

The From address doesn't match the sign-in (5.7.60)

5.7.60 SMTP; Client does not have permissions to send as this sender: “This error indicates that the device is trying to send an email from an address that doesn't match the logon credentials.” Two fixes from Microsoft: “If the printer or application wants to send email from another account, the login account should have Send As permission for that account.” Or, if the device has to send from many addresses: “If your application or printer behaves this way, use Microsoft 365 or Office 365 SMTP relay because SMTP client submission does not support this scenario.”

A connector stopped recognising the device (5.7.64)

5.7.64 TenantAttribution; Relay Access Denied appears on the SMTP relay route, where a connector recognises your device. “A common cause of this issue is a change in your dedicated and static IP address or a change in the certificate used by your application or device.” Microsoft's fix is to update the inbound connector with the new IP address or certificate.

Microsoft's diagnostic

“If you still need help to fix issues with applications or devices sending email using Microsoft 365, you can run an automated diagnostic.” It runs in the Microsoft 365 admin center and requires a Microsoft 365 administrator account.

Sources: Microsoft Learn, Fix issues with printers, scanners, and LOB apps that send email using Microsoft 365; Microsoft Learn, Enable or disable authenticated client SMTP submission (SMTP AUTH) in Exchange Online (read October 30, 2026)

By brand

Where the maker supports OAuth for Microsoft 365, that's the first fix to try. What each maker's own pages say:

• Canon: OAuth for Microsoft 365 on supported models and firmware.
• Ricoh: OAuth for Microsoft 365 on supported models and firmware. Showing “Authentication with the destination has failed”? Ricoh's message, explained.
• Xerox: OAuth for Microsoft 365 on supported models and firmware.
• HP: OAuth for Microsoft 365 isn't stated on the pages we read.
• Konica Minolta: OAuth for Microsoft 365 on supported models and firmware.
• Kyocera: OAuth for Microsoft 365 on supported models and firmware.
• Sharp: OAuth for Microsoft 365 on supported models and firmware.
• Brother: OAuth for Microsoft 365 on supported models and firmware.
• Epson: OAuth for Microsoft 365 on supported models and firmware.
• Lexmark: OAuth for Microsoft 365 on supported models and firmware.

If it stopped because basic authentication was turned off

Microsoft's notice MC786329: “End of December 2026: SMTP AUTH Basic Authentication will be disabled by default for existing tenants.” A device that signs in with a password needs a new route. These don't depend on password sign-in:

• OAuth on the device. SMTP AUTH supports OAuth as well as passwords, and it's the method Microsoft recommends. It works if your copier's maker supports it on your model and firmware: see the guide and your brand's page.
• An SMTP relay connector. The device sends to your MX endpoint on port 25, and Microsoft 365 recognises it by your static IP address or a certificate. Steps.
• Direct Send or High Volume Email, if scans only ever go to people inside your organization. Details.
• A third-party relay, which Microsoft's notice names for anything that must keep a username and password: “if you must use Basic auth to send email with Exchange Online, then you must use one of the alternatives or a 3P solution.”

Common questions