5.7.139 Authentication unsuccessful, basic authentication is disabled

Your copier, scanner or app sent mail through smtp.office365.com and Microsoft 365 answered with 5.7.139. The password is usually fine. What Microsoft is refusing is the way of signing in.

What the error means

The device signs in to smtp.office365.com with a username and password (SMTP AUTH with basic authentication), and your Microsoft 365 organization no longer accepts that. Microsoft documents the code as part of the SMTP reply, usually starting with 535; some copier logs and bounce messages show it as 550, or quote only the 5.7.139 part. The text after it tells you what turned it off:

"basic authentication is disabled": password sign-in is blocked for the organization or that mailbox.
"SmtpClientAuthentication is disabled for the Tenant" or "for the Mailbox": SMTP AUTH itself is switched off. That blocks OAuth SMTP from the copier as well, not just passwords (see Microsoft's SMTP AUTH settings page).
"user is locked by your organization's security defaults policy": security defaults are on, and they block basic authentication.

Microsoft's dates. In its January 27, 2026 timeline update (revised January 29), the Exchange team says SMTP AUTH with basic authentication keeps working unchanged until the end of December 2026. Then it is disabled by default for existing Microsoft 365 organizations, and admins can still turn it back on. Organizations created after December 2026 don't get it by default. Microsoft says it will announce the final removal date in the second half of 2027.

So from January 2027 more organizations will see this error, and some see it already because an admin or security defaults turned basic authentication off early.

Check before you change anything

Open the copier's web page (its IP address in a browser), sign in as administrator and find the SMTP settings. If the server is smtp.office365.com, port 587, with a mailbox address and password, this is your cause.
In the Microsoft 365 admin center, open the scanner mailbox, then Mail, then Manage email apps, and look at "Authenticated SMTP". In the Exchange admin center, Reports, Mail flow, the SMTP AUTH clients report lists what still signs in this way.
Check whether security defaults are on in Microsoft Entra ID. If they are, password SMTP stays blocked whatever the mailbox setting says.

The free options, honestly

Microsoft documents these in how to set up a multifunction device or application to send email. Each one is free from Microsoft's side, and each has a catch.

1. OAuth on the copier

If the copier's firmware can sign in to Microsoft 365 with OAuth (modern authentication), use it. It's what Microsoft wants and needs nothing extra. The catch: many older models never get it, some need a dealer visit for the firmware, and an admin usually has to approve the copier maker's app in the tenant.

2. Direct send

The copier sends straight to your domain's MX endpoint (like contoso-com.mail.protection.outlook.com) on port 25, with no sign-in. Microsoft's catches: it only delivers to mailboxes in your own organization (scans to a customer or your accountant are rejected), port 25 must be open outbound, it's treated like anonymous internet mail, and Microsoft recommends a static IP for the SPF record. Microsoft also says it is "working on an option to disable Direct Send by default".

3. An SMTP relay connector

An admin creates an inbound connector in Exchange Online that trusts your office's public IP address or a TLS certificate, and the copier sends to the MX endpoint on port 25. It can send to outside addresses. The catches: Microsoft says dynamic IP addresses aren't supported, so you need a static IP that isn't shared with anyone else (or a certificate the copier can present), port 25 must be open, the IP goes in your SPF record, and someone has to keep it right if the IP changes.

4. High Volume Email (HVE)

Microsoft's High Volume Email lists printers and scanners as a use case. The copier signs in to smtp.hve.mx.microsoft on port 587 with an HVE account, using a password or OAuth, and it still works when SMTP AUTH is turned off for the tenant. The catches: internal recipients only, messages up to 10 MB, TLS required, and it's billed pay as you go through an Azure subscription ($42 per million recipients at the time of writing). The cost for a copier is tiny; the Azure billing setup is the work. If security defaults are on, it only accepts OAuth.

5. Turn basic authentication back on

After the December change an admin can switch SMTP AUTH back on for the scanner mailbox. Nothing changes on the copier, but it's temporary (Microsoft will set a final date) and leaves a password-only sign-in open. How, and the trade-offs.

Microsoft's page also points devices that must reach outside recipients at Azure Communication Services Email, which is a paid Azure service with its own setup.

Where Scan Relay fits

Scan Relay is a small Windows program I make for the copiers the free options don't suit: no OAuth firmware, no static IP, scans that go to outside addresses, or nobody available to own a connector and SPF. It runs as a service on an always-on office PC. The copier sends to that PC on the local network (port 25, any username and password), and Scan Relay sends each scan on to Microsoft 365 through Microsoft Graph with OAuth, as the mailbox you signed in with.

Works with any copier or scanner that can scan to email over SMTP, without a firmware update, static IP, connector or DNS change.
Delivers to outside addresses as well as your own staff.
Saves each scan on the PC first and retries if the internet drops.
Limits, so you can decide: it needs a Windows PC that stays on; it sends up to about 3 MB per email (set the copier to split scans at 3 MB); a Microsoft 365 admin approves it once per organization; and the program isn't code-signed yet, so Windows SmartScreen shows a warning the first time. How it handles your mail.

Free for 14 days, then $99 once per office (one PC, any number of copiers). Full refund within 30 days if it doesn't work with your copier.

Scan Relay: free 14-day trial Check if your copier is affected

Questions

Is the 5.7.139 error a wrong password?
Usually not. It means Microsoft 365 refuses username-and-password (basic) sign-in for SMTP, for the whole organization or that mailbox. Re-entering the password will not help.

Why does my log say 550 5.7.139 and Microsoft says 535?
Microsoft documents the error with SMTP reply code 535. Some copiers and bounce messages report it with 550 or show only 5.7.139. The meaning is the same: basic authentication was refused.

When does Microsoft turn off SMTP AUTH basic authentication?
Microsoft's January 27, 2026 timeline says it is disabled by default for existing Microsoft 365 organizations at the end of December 2026. Admins can still turn it back on, and Microsoft says it will announce the final removal date in the second half of 2027.

Is direct send a free fix for scan to email?
It's free, but it only delivers to mailboxes in your own Microsoft 365 organization, needs outbound port 25, and Microsoft recommends a static IP for SPF. Scans to outside addresses are rejected.

What does Scan Relay cost?
$99 once per office after a free 14-day trial, covering one PC and any number of copiers. Full refund within 30 days if it does not work with your copier.