Scan to Email Office 365: Copier Setup, Errors and the 2026 Change

A copier or multifunction printer can’t deliver email on its own; it hands each scan to a mail server. With Microsoft 365 (still widely called Office 365) there are a few Microsoft-documented routes, and many failures come down to a route your tenant doesn’t allow or the device can’t meet.

Start by finding out which route your device uses. If its SMTP server is smtp.office365.com and it signs in with a mailbox and password, it’s using SMTP AUTH client submission. If the server name ends in mail.protection.outlook.com (or mx.microsoft on some newer domains) and there’s no password, it’s direct send or SMTP relay.

It matters now because, as of October 2026, Microsoft plans to turn off password sign-in to SMTP AUTH (Basic authentication) by default at the end of December 2026, and many copiers are set up that way.

Which sending method should your copier use?

Pick by who you scan to and what the device supports:

For a scan to email Microsoft 365 setup in most small offices: if the copier’s firmware offers Microsoft 365 or OAuth sign-in, use client submission with OAuth. If it doesn’t and you have a static IP, use an Office 365 SMTP relay connector. With neither, see the options under the Basic authentication change below; password sign-in is only a stopgap.

For scans that only go to coworkers, Microsoft points to High Volume Email; it recommends direct send only for devices that support nothing else. Offices on Google Workspace need different settings: see Gmail SMTP and app passwords.

Set up SMTP AUTH client submission correctly

On the copier

Setting names vary by model.

In Microsoft 365

• Use a dedicated licensed mailbox, such as scanner@yourdomain.com, rather than a person’s account, so a password change or departure doesn’t stop scanning.
• Turn on Authenticated SMTP for that mailbox only. In the Microsoft 365 admin center, go to Users > Active users, select the mailbox, select Mail, then Manage email apps, tick Authenticated SMTP and select Save changes. In Exchange Online PowerShell: Set-CASMailbox -Identity scanner@yourdomain.com -SmtpClientAuthenticationDisabled $false. It’s off by default in tenants created after January 2020. OAuth sign-in needs it on too.
• Security defaults blocks it. If security defaults is on in Microsoft Entra ID, SMTP AUTH is already disabled, and there’s no per-account exemption. Don’t turn it off just for the copier: that removes MFA for every account unless you replace it with Conditional Access (Microsoft Entra ID P1, included in Business Premium). A relay connector is usually the safer route.
• Conditional Access. If a policy blocks legacy authentication, Microsoft’s documented fix is to exclude only the scanner mailbox from it. It then signs in with a password alone, so give it a long, unique password and no admin roles, and change the copier’s default admin password.

The SMTP AUTH Basic authentication change: dates as of October 2026

Dated facts, checked October 19, 2026. As of October 2026, Microsoft’s latest Exchange Team blog post on this, published January 27, 2026, sets this timeline for the SMTP AUTH Basic authentication retirement in Exchange Online:

• Now to December 2026: Basic authentication behavior remains unchanged.
• End of December 2026: Basic authentication is disabled by default for existing tenants. Admins will still be able to turn it on if needed.
• New tenants created after December 2026: Basic authentication is unavailable by default, and OAuth is the supported method.
• Second half of 2027: Microsoft will announce the final removal date.

That post replaced the September 2025 deadline from Microsoft’s April 2024 announcement and the later March–April 2026 dates that older articles still cite. Recheck it before the end of December 2026 and again in the second half of 2027.

What it means for your copier

If your scanner signs in to smtp.office365.com with a password, expect it to stop sending at the end of December 2026 unless an admin turns Basic authentication back on, which is only a stopgap. Your options, best first:

1. Update the firmware and switch to OAuth. Many current copier and MFP models offer Microsoft 365 or OAuth 2.0 sign-in for scan to email; check the firmware notes or ask your dealer. Setup usually needs a Microsoft 365 admin to register or approve the device’s app in Microsoft Entra ID, and security defaults blocks devices that sign in with a code entered on another screen. OAuth isn’t affected by the change.
2. Use an SMTP relay connector if the office has a static public IP. No password is stored on the copier.
3. Send through another service: High Volume Email for internal mail, or Azure Communication Services Email or a third-party SMTP service for outside recipients.
4. Use direct send only if scans go solely to coworkers and nothing above fits; Microsoft says most customers don’t need it.
5. Scan to a network folder or cloud storage instead, if the device supports it.

To see which devices still use a password, open the SMTP AUTH Clients report under Reports > Mail flow in the Exchange admin center. It shows Basic authentication as TlsAuthLogin and OAuth as XOAUTH2.

Direct send and SMTP relay: the details that trip people up

• Find your MX endpoint in the Microsoft 365 admin center under Settings > Domains: select the domain, open DNS records, select the MX record and copy its Points to address or value, which often looks like yourdomain-com.mail.protection.outlook.com. Some newer domains get an endpoint ending in mx.microsoft instead, so copy the value rather than building it from the pattern. Don’t use an IP address.
• Port 25 must be open outbound. A direct send multifunction printer and an SMTP relay both use it, and some providers and firewalls block it; if yours can’t be unblocked, use client submission on port 587.
• Direct send only reaches your own mailboxes; mail to Gmail, Yahoo or a client’s domain is rejected by design. It’s handled like anonymous internet mail, so add your office’s static IP to your SPF record or scans may land in Junk.
• Direct send can be switched off. Microsoft is working on disabling it by default, and admins can already block it with Set-OrganizationConfig -RejectDirectSend $true to stop spoofed internal mail. If direct send scanning stopped suddenly, check Get-OrganizationConfig | Format-List RejectDirectSend.
• Relay needs a connector. In the Exchange admin center, go to Mail flow > Connectors, select Add a connector, choose Your organization’s email server, and authenticate by your office’s public IP address or a certificate. Microsoft doesn’t support dynamic IP addresses for this, and the IP must belong only to your organization. Add it to SPF too. The connector trusts anything from that IP, an infected PC included, so block outbound port 25 for everything but the copier if your firewall allows.

Scans sent as your domain to outside recipients also have to pass SPF, DKIM and DMARC. If Gmail bounces them with a 5.7.26 error, see 550 5.7.26 unauthenticated email; setting those records up properly is part of our email security setup.

Common scan-to-email errors and what they mean

Copier scan to email not working, with no detail on the screen? Many copiers just say “SMTP error” or “authentication failed”; look in the device’s email or job log for the server’s numeric reply:

Test it step by step

1. Test the network path from a PC on the copier’s network. In PowerShell, run Test-NetConnection smtp.office365.com -Port 587, or your MX endpoint with -Port 25 for direct send or relay. TcpTestSucceeded : True means the port is open; False points at a firewall or your internet provider.
2. Send a one-page test scan to an internal address first, then an outside one.
3. Follow the message. In the Exchange admin center, Mail flow > Message trace shows whether Microsoft 365 accepted it and what happened next; new messages can take a few minutes to appear. If it never shows up, the copier either couldn’t connect or was refused while sending, so check its email log for the reply code.

When it’s the copier, and when to get help

• No TLS 1.2 and no firmware update available: the device can’t use client submission. Direct send or a relay connector may keep it working; otherwise it’s near the end of its useful life for email.
• Settings page won’t open: the copier has probably changed IP address or dropped off the network; see network printer offline in Windows 11 to find it.
• Leased copiers: firmware updates and some settings are often handled by the dealer, so ask before changing them.
• Scanner hardware: lines on scans, feeder jams or blank pages are mechanical, and email settings won’t help.
• No admin access: Authenticated SMTP, connectors and reports all need a Microsoft 365 admin; if nobody in the office has those rights, recover admin access first.

Many scan-to-email problems can be fixed remotely through the copier’s browser-based settings page, though some settings need its admin password or your dealer. If you’d rather hand it off, this is a typical $59 remote fix through remote computer help.

Ongoing Microsoft 365 admin, such as SMTP AUTH settings and relay connectors, is covered by our Microsoft 365 management; copier hardware and dealer-managed firmware aren’t.

Common questions

What SMTP settings does a copier need for Office 365?

For the most common setup, the copier sends through smtp.office365.com on port 587 with STARTTLS, and signs in with the full address and password of a licensed mailbox that has Authenticated SMTP enabled. The sender address should be that same mailbox. A device that only offers SSL on port 465 can’t use this route and needs a relay connector or another method instead.

Will scan to email stop working in December 2026?

It might, if your copier signs in to Microsoft 365 with a password. As of October 2026, Microsoft’s latest timeline, from its January 27, 2026 Exchange Team post, says SMTP AUTH Basic authentication will be disabled by default for existing tenants at the end of December 2026, though admins can still turn it back on, and that a final removal date will be announced in the second half of 2027. Devices using OAuth, direct send or a relay connector aren’t affected.

Can scans be sent from a shared mailbox address?

With client submission, the copier must sign in with a licensed mailbox, and sending as another address needs Send As permission on it. With direct send or an SMTP relay connector, the copier can use any address in your domain, even one with no mailbox, such as scans@ or noreply@. That makes relay a good fit when you don’t want to license a mailbox just for the copier.

Why can our copier email coworkers but not outside addresses?

If it uses direct send, that’s by design: Microsoft only accepts direct-send mail for mailboxes in your own organization. To reach outside recipients, switch to client submission or an SMTP relay connector. If you already use one of those and only outside mail fails, check whether the scans fail SPF, DKIM or DMARC checks at the recipient’s end, which shows up as a bounce from their server.

Why did scan to email stop after we turned on security defaults or MFA?

Security defaults turns off SMTP AUTH in Exchange Online, and a copier can’t answer an MFA prompt, so password-based scanning fails. Security defaults is all or nothing: it can’t exempt one account, and switching it off removes protection for every user. A relay connector avoids the conflict, as does OAuth firmware that doesn’t sign in with a code entered on another screen. A scanner-only exception needs Conditional Access (Microsoft Entra ID P1) in place of security defaults.

Can we use an app password for the scanner mailbox?

Usually not, and it won’t last. App passwords are a legacy per-user MFA feature that an admin has to allow, and they stop working wherever security defaults or a Conditional Access policy blocks legacy authentication. They’re also still Basic authentication, so the December 2026 default change affects them like any other password. OAuth firmware or a relay connector is the longer-term answer.

Is direct send safe to use for scan to email?

Microsoft says direct send is secure and workable when it’s configured and managed correctly, but recommends it only for admins comfortable with email server responsibilities and says most customers don’t need it. Mail arrives like anonymous internet mail, so list your office IP in SPF and set up DKIM and DMARC for the domain. Some admins block direct send to stop spoofed internal mail, which also stops a copier that relies on it.