Scan to email with Microsoft 365 after December 2026

What's changing

“End of December 2026: SMTP AUTH Basic Authentication will be disabled by default for existing tenants.”Microsoft 365 Message Center, notice MC786329, updated January 27, 2026

Tenants created after December 2026 won't have basic SMTP AUTH at all. Admins of existing tenants can still turn it back on for now, and Microsoft will announce the final removal date in the second half of 2027. The full timeline, and what turning it back on means.

Microsoft's notice is direct about what to do instead: “if you must use Basic auth to send email with Exchange Online, then you must use one of the alternatives or a 3P solution.” A 3P solution is a third-party one.

Check whether your device is affected

Open the device's scan-to-email settings. Office copiers and scanners usually have a built-in web page: type the device's IP address into a browser on the same network, sign in as the administrator, and find the email or SMTP section. Some show the same settings on the front panel.

Your options at a glance

Microsoft lists the alternatives as OAuth on the device, High Volume Email (internal recipients only), an on-premises Exchange relay, or a third-party solution. Its setup article adds SMTP relay through a connector and Direct Send.

Source: Microsoft Learn, How to set up a multifunction device or application to send email using Microsoft 365 or Office 365 (read October 30, 2026)

1. OAuth on the device

The device signs in to Microsoft 365 with OAuth instead of a stored password. It's still SMTP AUTH, so it keeps working after December 2026, and it's the method Microsoft recommends for client SMTP submission.

When it fits

Your copier's maker supports OAuth for Microsoft 365 on your model and firmware. Check your brand's page: Canon, Ricoh, Xerox, HP, Konica Minolta, Kyocera, Sharp, Brother, Epson, Lexmark.

How to set it up

1. Update the device's firmware to the version its maker lists for Microsoft 365 OAuth.
2. In the email or SMTP settings, choose the OAuth, modern authentication or Microsoft 365 option.
3. Sign in with the mailbox the device should send from, following the maker's steps.
4. Make sure Authenticated SMTP is on for that mailbox (the steps are below). Device makers' OAuth guides ask for it too.
5. Keep the server at smtp.office365.com, port 587, with TLS on (TLS 1.2 or TLS 1.3).
6. Send a test scan to an address inside and one outside your organization.

Source: Microsoft Learn, Authenticate an IMAP, POP or SMTP connection using OAuth (read October 30, 2026)

2. Turn basic SMTP AUTH back on, for now

The notice says admins can still re-enable basic SMTP AUTH for now. It buys time, not a fix: Microsoft will announce the final removal date in the second half of 2027.

For one mailbox (recommended)

1. Open the Microsoft 365 admin center and go to Users > Active users.
2. Select the user, and in the flyout select Mail.
3. In the Email apps section, select Manage email apps.
4. Check Authenticated SMTP, then select Save changes.

Or in Exchange Online PowerShell:

Set-CASMailbox -Identity scanner@example.com -SmtpClientAuthenticationDisabled $false

For the whole organization

In the Exchange admin center, the Mail flow settings page has a toggle labelled Turn off SMTP AUTH protocol for your organization. In PowerShell:

Set-TransportConfig -SmtpClientAuthenticationDisabled $false

Microsoft recommends keeping SMTP AUTH off for the organization and enabling it only for the mailboxes that still need it. The mailbox setting takes precedence over the organization setting.

Device settings for this route

Server

smtp.office365.com (don't use an IP address)

Port

587 (recommended) or 25

Encryption

TLS/STARTTLS on, TLS 1.2 or TLS 1.3

Username and password

The sign-in of a licensed mailbox

Sending limits

10,000 recipients per day. 30 messages per minute.

If the device sends from a different address than the one it signs in with, the sign-in account needs Send As permission on that mailbox. The full settings are on our Office 365 SMTP settings page.

Source: Microsoft Learn, Enable or disable authenticated client SMTP submission (SMTP AUTH) in Exchange Online (read October 30, 2026)

3. SMTP relay with a connector

The device sends to your domain's MX endpoint, and Microsoft 365 recognises it by a certificate or by your office's static public IP address through an inbound connector. No mailbox password is involved.

What you need

• A static public IP address that isn't shared with another organization, or a certificate. Dynamic IPs aren't supported.
• Port 25 open on your network. Some firewalls and internet providers block it.
• An SPF record for your domain, so messages aren't flagged as spam.

How to set it up

1. In the Exchange admin center, go to Mail flow > Connectors and select Add a connector.
2. Connection from: Your organization's email server. Connection to: Office 365 (selected for you).
3. Name the connector, leave Turn it on selected, and leave Retain internal Exchange email headers unselected.
4. Choose how Microsoft recognises your device: by the certificate's subject name matching your domain (Microsoft's recommendation), or by the IP addresses that belong exclusively to your organization.
5. Review and select Create connector.
6. Add or update your domain's SPF record at your DNS provider.
7. On the device, set the server to your MX endpoint (find it under Show all > Settings > Domains in the admin center), port 25, and send a test.

Source: Microsoft Learn, How to set up a multifunction device or application to send email using Microsoft 365 or Office 365 (read October 30, 2026)

4. Direct Send

The device sends unauthenticated mail straight to your MX endpoint, like any outside mail server would.

“Can't deliver email to external recipients (for example, recipients with Yahoo! or Gmail addresses).”Microsoft Learn, on Direct Send

What you need

• Port 25 open.
• A From address in a domain your Microsoft 365 tenant accepts (no mailbox needed).
• SPF (a static IP address is recommended for it), DKIM and DMARC set up for the domain.
• Device settings: server = your MX endpoint, port 25, TLS optional, no username or password.

Source: Microsoft Learn, How to set up a multifunction device or application to send email using Microsoft 365 or Office 365 (read October 30, 2026)

5. High Volume Email

High Volume Email (HVE) uses dedicated HVE accounts, not mailboxes, for apps and devices that send email inside your organization. HVE accounts don't need Microsoft 365 licenses, but each one must be tied to a billing policy linked to an Azure subscription for usage-based billing. Without one, the account can't send.

Server

smtp.hve.mx.microsoft (recommended) or smtp-hve.office365.com (to be deprecated)

Port

587, TLS on

Sign-in

The HVE account's credentials, or an OAuth token

Recipients

Internal recipients within the tenant only; up to 50 per message

How to set it up

1. In the Exchange admin center, select Mail flow, then High Volume Email.
2. Select Add an HVE account and enter a display name, primary email address and password.
3. Choose a pay-as-you-go billing policy, review, and select Create.

If security defaults are on in Microsoft Entra ID, HVE accounts can sign in only with OAuth.

Source: Microsoft Learn, Manage High Volume Email for Microsoft 365 (read October 30, 2026)

6. An on-premises Exchange relay

If you still run Exchange Server on site, it can accept mail from your copiers and pass it on. Microsoft's method is a dedicated Receive connector in the Front End Transport service that allows anonymous relay only from a list of internal hosts.

How to set it up

1. In the Exchange admin center, go to Mail flow > Receive connectors and click Add.
2. Name it (for example, Anonymous Relay). Role: Frontend Transport. Type: Custom.
3. Keep the binding on port 25.
4. Under Remote network settings, remove the default range and add only your devices' IP addresses.
5. Then, in the Exchange Management Shell:

Set-ReceiveConnector "Anonymous Relay" -PermissionGroups AnonymousUsers
Get-ReceiveConnector "Anonymous Relay" | Add-ADPermission -User "NT AUTHORITY\ANONYMOUS LOGON" -ExtendedRights "Ms-Exch-SMTP-Accept-Any-Recipient"

Source: Microsoft Learn, Allow anonymous relay on Exchange servers (read October 30, 2026)

7. A third-party relay

Microsoft's notice names a third-party solution as one of the ways forward. A relay accepts the device's username and password and handles Microsoft's sign-in itself.

CopierBridge is one. Each message goes out from your own mailbox through Microsoft's own mail service, signed in with OAuth and permission to send only (the SMTP.Send permission Microsoft documents for SMTP). Nothing we hold can read the mailbox, and we don't store messages.

How to set it up

1. Turn on Authenticated SMTP for the mailbox the device sends as, following Microsoft's steps for one mailbox:
   1. Open the Microsoft 365 admin center and go to Users > Active users.
   2. Select the user (the mailbox the device sends as), and in the flyout select Mail.
   3. In the Email apps section, select Manage email apps.
   4. Check Authenticated SMTP, then select Save changes.
   Microsoft's page: Enable or disable authenticated client SMTP submission (SMTP AUTH) in Exchange Online.
2. Connect the mailbox with Microsoft's own sign-in. The mailbox owner approves sending only as that mailbox.
3. Add the device and copy the username and password we create for it.
4. Type four values into the copier and send a test scan:

It costs $9 a device a month, and your first device is free for 14 days. Start free.

Which one should you pick?

1. Your device supports OAuth for Microsoft 365? Use OAuth on the device.
2. Scans only ever go to people inside your organization? Direct Send or High Volume Email can work. HVE bills by usage through an Azure subscription.
3. A static IP at the office, port 25 open, and someone comfortable in the Exchange admin center? An SMTP relay connector.
4. Still running Exchange Server? An on-premises relay.
5. None of the above? A third-party relay. Turning basic SMTP AUTH back on buys time until the final removal date, which Microsoft will announce in the second half of 2027.

Common questions

More in the FAQ.