Scan to email across many client offices

If you look after dozens of client offices, Microsoft's SMTP AUTH change is one ticket per MFP. Here's how to find them, which fix suits which site, and how Scan Relay rolls out from an RMM tool.

Microsoft's dates. In its January 27, 2026 timeline update (revised January 29), the Exchange team says SMTP AUTH with basic authentication keeps working unchanged until the end of December 2026. Then it is disabled by default for existing Microsoft 365 organizations, and admins can still turn it back on. Organizations created after December 2026 don't get it by default. Microsoft says it will announce the final removal date in the second half of 2027.

Find the affected devices

Paste your client domains into the domain checker to see which are on Microsoft 365 (it exports a CSV).
In each tenant, the SMTP AUTH clients report (Exchange admin center, Reports, Mail flow) and the Entra sign-in logs filtered to Authenticated SMTP show the mailboxes still signing in with a password.
Match those mailboxes to your copier fleet list or your dealer's.

Pick a fix per site

Site	Fix
MFP gets OAuth with current firmware	Firmware plus the maker's app consent in the tenant
Static IP, scans only to staff	Direct send or a connector, if you'll own SPF and port 25 there
Scans only to staff, client OK with Azure billing	High Volume Email
Older MFPs, dynamic IP, scans to outside addresses	A local relay such as Scan Relay

The free options, honestly

Microsoft documents these in how to set up a multifunction device or application to send email. Each one is free from Microsoft's side, and each has a catch.

1. OAuth on the copier

If the copier's firmware can sign in to Microsoft 365 with OAuth (modern authentication), use it. It's what Microsoft wants and needs nothing extra. The catch: many older models never get it, some need a dealer visit for the firmware, and an admin usually has to approve the copier maker's app in the tenant.

2. Direct send

The copier sends straight to your domain's MX endpoint (like contoso-com.mail.protection.outlook.com) on port 25, with no sign-in. Microsoft's catches: it only delivers to mailboxes in your own organization (scans to a customer or your accountant are rejected), port 25 must be open outbound, it's treated like anonymous internet mail, and Microsoft recommends a static IP for the SPF record. Microsoft also says it is "working on an option to disable Direct Send by default".

3. An SMTP relay connector

An admin creates an inbound connector in Exchange Online that trusts your office's public IP address or a TLS certificate, and the copier sends to the MX endpoint on port 25. It can send to outside addresses. The catches: Microsoft says dynamic IP addresses aren't supported, so you need a static IP that isn't shared with anyone else (or a certificate the copier can present), port 25 must be open, the IP goes in your SPF record, and someone has to keep it right if the IP changes.

4. High Volume Email (HVE)

Microsoft's High Volume Email lists printers and scanners as a use case. The copier signs in to smtp.hve.mx.microsoft on port 587 with an HVE account, using a password or OAuth, and it still works when SMTP AUTH is turned off for the tenant. The catches: internal recipients only, messages up to 10 MB, TLS required, and it's billed pay as you go through an Azure subscription ($42 per million recipients at the time of writing). The cost for a copier is tiny; the Azure billing setup is the work. If security defaults are on, it only accepts OAuth.

5. Turn basic authentication back on

After the December change an admin can switch SMTP AUTH back on for the scanner mailbox. Nothing changes on the copier, but it's temporary (Microsoft will set a final date) and leaves a password-only sign-in open. How, and the trade-offs.

Microsoft's page also points devices that must reach outside recipients at Azure Communication Services Email, which is a paid Azure service with its own setup.

Rolling out Scan Relay

The same ScanRelay.exe installs without prompts when run as SYSTEM or administrator:

ScanRelay.exe install --quiet --license KEY --alert-email noc@yourmsp.com --webhook https://...

ScanRelay.exe status exits 0 (working), 1 (warning), 2 (not working) or 3 (service not running), for an RMM check.
Alerts go to email, a webhook (Teams, Slack, your PSA) and the Windows event log (source ScanRelay, fixed event IDs).
Running the installer again updates in place and keeps settings and sign-in.
The step you can't script: someone signs in with the scanner mailbox in a browser on that PC, and a Microsoft 365 admin approves Scan Relay once per tenant.

Pricing for IT providers

Licenses are one-time, one per office, with free updates and no subscription for you or the client. Wholesale packs are $29 per office for 10, $25 for 25 and $19 for 100; a single office is $99. Keys appear on the page right after checkout, and unused licenses are refunded within 30 days. Every install starts with the free 14-day trial, so you can test a site before buying.

See the wholesale packs Download the free trial

Need more than 100 licenses or invoicing? Email tyler@leducsystems.com.

Questions

Can I roll Scan Relay out with an RMM tool?
Yes. ScanRelay.exe install --quiet takes the license key, alert email and webhook on the command line, and ScanRelay.exe status returns an exit code an RMM check can watch. Only the Microsoft 365 sign-in has to be done in a browser on each PC.

Is there a subscription?
No. Each office license is a one-time payment with free updates. Wholesale packs are $29, $25 and $19 per office at 10, 25 and 100 offices.

Do client scans pass through your servers?
No. Scans go from the office PC straight to Microsoft Graph. Scan Relay only contacts the LeDuc Systems server to check a license key.

When does Microsoft turn off SMTP AUTH basic authentication?
Microsoft's January 27, 2026 timeline says it is disabled by default for existing Microsoft 365 organizations at the end of December 2026. Admins can still turn it back on, and Microsoft says it will announce the final removal date in the second half of 2027.