Why your copier will stop scanning to email in Microsoft 365

Most office copiers send scan to email by signing in to Microsoft 365 with a username and password, a method called SMTP AUTH with basic authentication. Microsoft is turning that method off by default for existing Microsoft 365 tenants at the end of December 2026. If your copier still uses it, scans will stop arriving in inboxes the first time someone hits Scan after the change, and the copier will usually show nothing more helpful than a send error.

Microsoft’s Exchange team published the timeline on January 27, 2026. Until the end of December 2026, nothing changes. After that, basic authentication for SMTP AUTH is off by default for existing tenants, and new tenants won’t have it at all. An administrator can still turn it back on, but Microsoft says it will announce a final removal date in the second half of 2027, so turning it back on only buys time (Microsoft Tech Community).

How to tell if your copier is affected

Check the scan to email settings on the copier’s web page. If the outgoing server is smtp.office365.com on port 587, with a username and password for a mailbox, the copier uses SMTP AUTH. In the Exchange admin center, the SMTP AUTH clients report under Reports, Mail flow lists every sender using it and marks each one as Basic Auth or Modern Auth. Scanners, line-of-business apps and old scripts usually show up there together.

One more catch: if your tenant uses Microsoft’s security defaults, SMTP AUTH is already blocked, according to Microsoft Learn. If your copier still scans to email in a tenant like that, it’s using some other route, so find out which one before you change anything.

The fixes, in the order we’d try them

1. Switch the copier to OAuth if its firmware supports it

Many current copiers and multifunction printers can sign in to Microsoft 365 with OAuth (modern authentication) instead of a stored password. Look for OAuth or modern authentication in the copier’s email settings or the maker’s firmware notes. If it’s there, this is the cleanest fix: the copier keeps sending as a mailbox, and nothing about your mail flow changes.

2. Send through an SMTP relay connector

If the copier can’t do OAuth, Microsoft’s guide for multifunction devices lists SMTP relay: an inbound connector in Exchange Online that accepts mail from your office’s static public IP address (or a certificate) on port 25. It doesn’t use a mailbox password at all, and it can send to people outside your organization. It needs a static IP and a firewall that allows the copier out on port 25.

3. Scan to a folder or to the cloud instead

Many offices only email scans to themselves so they can file them. Scanning straight to a SharePoint or OneDrive folder, or to a network folder, skips email entirely and puts the document where it belongs. It’s often the better workflow for patient intake forms, signed engagement letters and invoices.

4. Turn basic authentication back on, as a stopgap

This works after December, until Microsoft’s final removal date. We’d use it only to keep scanning running while one of the fixes above gets done, and we’d track which devices depend on it.

How we handle it

We’d start with the SMTP AUTH clients report, match every Basic Auth sender to a copier, scanner or application, and move each one to OAuth or a relay connector before the end of December. For copiers under our managed print service, we’d make that change for you. If you have a copier from another dealer, the fix is the same; it just takes a call to them for the firmware piece.

If you’re not sure how your scanners send email, Book a 15-minute call and we’ll tell you what we’d check first. See our Microsoft 365 managed services and managed print services.

Frequently asked questions