535 5.7.139 and 5.7.57 Client not authenticated to send mail

These two errors look alike and often show up together in a copier log. One says the sign-in was refused; the other says the device tried to send without being signed in at all.

535 5.7.139 Authentication unsuccessful

The device tried to sign in to smtp.office365.com with a username and password and Microsoft 365 said no, because basic authentication or SMTP AUTH is off for the organization or the mailbox, or security defaults block it. The ending of the message says which. The 5.7.139 variants explained.

530 5.7.57 Client not authenticated to send mail

This one usually appears at the MAIL FROM step: the device started sending without a successful sign-in. Common causes:

SMTP authentication is switched off on the copier, so it never tries to sign in. smtp.office365.com doesn't take anonymous mail.
The sign-in failed (for example with 5.7.139) and the copier carried on sending anyway, so the log shows 5.7.57 as the last error.
The copier is set to an auth method Microsoft 365 doesn't offer, or STARTTLS is off, so it skips sign-in. smtp.office365.com needs STARTTLS on port 587 with TLS 1.2 or 1.3.

If you only see 5.7.57, first check the copier's SMTP authentication and TLS settings. If you see 5.7.139 too, the root cause is the sign-in method, and fixing the copier's settings won't bring it back once basic authentication is off.

Other codes in the same log

5.7.60 Client doesn't have permissions to send as this sender: the copier's From address isn't the mailbox it signs in with, and that mailbox lacks Send As. Microsoft lists this in its device setup page.
5.7.3 or 5.7.8 Authentication unsuccessful: often a changed password, or a mailbox that requires MFA.

Microsoft's dates. In its January 27, 2026 timeline update (revised January 29), the Exchange team says SMTP AUTH with basic authentication keeps working unchanged until the end of December 2026. Then it is disabled by default for existing Microsoft 365 organizations, and admins can still turn it back on. Organizations created after December 2026 don't get it by default. Microsoft says it will announce the final removal date in the second half of 2027.

The free options, honestly

Microsoft documents these in how to set up a multifunction device or application to send email. Each one is free from Microsoft's side, and each has a catch.

1. OAuth on the copier

If the copier's firmware can sign in to Microsoft 365 with OAuth (modern authentication), use it. It's what Microsoft wants and needs nothing extra. The catch: many older models never get it, some need a dealer visit for the firmware, and an admin usually has to approve the copier maker's app in the tenant.

2. Direct send

The copier sends straight to your domain's MX endpoint (like contoso-com.mail.protection.outlook.com) on port 25, with no sign-in. Microsoft's catches: it only delivers to mailboxes in your own organization (scans to a customer or your accountant are rejected), port 25 must be open outbound, it's treated like anonymous internet mail, and Microsoft recommends a static IP for the SPF record. Microsoft also says it is "working on an option to disable Direct Send by default".

3. An SMTP relay connector

An admin creates an inbound connector in Exchange Online that trusts your office's public IP address or a TLS certificate, and the copier sends to the MX endpoint on port 25. It can send to outside addresses. The catches: Microsoft says dynamic IP addresses aren't supported, so you need a static IP that isn't shared with anyone else (or a certificate the copier can present), port 25 must be open, the IP goes in your SPF record, and someone has to keep it right if the IP changes.

4. High Volume Email (HVE)

Microsoft's High Volume Email lists printers and scanners as a use case. The copier signs in to smtp.hve.mx.microsoft on port 587 with an HVE account, using a password or OAuth, and it still works when SMTP AUTH is turned off for the tenant. The catches: internal recipients only, messages up to 10 MB, TLS required, and it's billed pay as you go through an Azure subscription ($42 per million recipients at the time of writing). The cost for a copier is tiny; the Azure billing setup is the work. If security defaults are on, it only accepts OAuth.

5. Turn basic authentication back on

After the December change an admin can switch SMTP AUTH back on for the scanner mailbox. Nothing changes on the copier, but it's temporary (Microsoft will set a final date) and leaves a password-only sign-in open. How, and the trade-offs.

Microsoft's page also points devices that must reach outside recipients at Azure Communication Services Email, which is a paid Azure service with its own setup.

Where Scan Relay fits

Scan Relay is a small Windows program I make for the copiers the free options don't suit: no OAuth firmware, no static IP, scans that go to outside addresses, or nobody available to own a connector and SPF. It runs as a service on an always-on office PC. The copier sends to that PC on the local network (port 25, any username and password), and Scan Relay sends each scan on to Microsoft 365 through Microsoft Graph with OAuth, as the mailbox you signed in with.

Works with any copier or scanner that can scan to email over SMTP, without a firmware update, static IP, connector or DNS change.
Delivers to outside addresses as well as your own staff.
Saves each scan on the PC first and retries if the internet drops.
Limits, so you can decide: it needs a Windows PC that stays on; it sends up to about 3 MB per email (set the copier to split scans at 3 MB); a Microsoft 365 admin approves it once per organization; and the program isn't code-signed yet, so Windows SmartScreen shows a warning the first time. How it handles your mail.

Free for 14 days, then $99 once per office (one PC, any number of copiers). Full refund within 30 days if it doesn't work with your copier.

Scan Relay: free 14-day trial Check if your copier is affected

Questions

What does 5.7.57 Client not authenticated to send mail mean?
The device started sending through smtp.office365.com without a successful sign-in. Either authentication is off on the copier, TLS is off so it skipped sign-in, or the sign-in failed and it carried on.

Does 5.7.139 mean SMTP AUTH is gone for good?
Not yet. Microsoft disables basic authentication by default at the end of December 2026 and admins can turn it back on for a while. The final removal date will be announced in the second half of 2027.

Is direct send a free fix for scan to email?
It's free, but it only delivers to mailboxes in your own Microsoft 365 organization, needs outbound port 25, and Microsoft recommends a static IP for SPF. Scans to outside addresses are rejected.

Can a copier use High Volume Email?
Yes, Microsoft lists printers and scanners as an HVE use case. It sends to internal recipients only, up to 10 MB per message, and is billed pay as you go through an Azure subscription.

What does Scan Relay cost?
$99 once per office after a free 14-day trial, covering one PC and any number of copiers. Full refund within 30 days if it does not work with your copier.