Scan to email stopped working with Office 365

Scans used to arrive and now they don't. With Microsoft 365 it's usually one of a few sign-in or settings problems. Here's the order I'd check them in.

1. Find out how the copier sends

Type the copier's IP address into a browser on the office network, sign in as administrator and open the email or SMTP settings. Write down the SMTP server, port, whether SSL/TLS is on, and the username. The typical Microsoft 365 setup is smtp.office365.com, port 587, STARTTLS on, and a mailbox address and password.

2. Look for the error

Most copiers keep a job log or email log on that same web page. The code tells you which problem you have:

Error	Usual cause
5.7.139 Authentication unsuccessful	Basic authentication or SMTP AUTH is off. More
5.7.57 Client not authenticated to send mail	The copier sent without signing in. More
5.7.3 / 5.7.8 Authentication unsuccessful	Changed or expired password, or MFA on the mailbox
5.7.60 no permission to send as this sender	The From address doesn't match the sign-in mailbox
TLS or connection error	Old firmware that can't do TLS 1.2, or port 587 blocked

No log? If nothing changed on the copier and several devices broke at once, suspect the Microsoft 365 side first.

3. Check the Microsoft 365 side

Microsoft 365 admin center: the scanner mailbox, Mail, Manage email apps, "Authenticated SMTP".
Microsoft Entra ID: whether security defaults are on (they block password SMTP).
Entra sign-in logs, filtered to the scanner mailbox: failed "Authenticated SMTP" attempts and the reason.
Whether the mailbox password was changed recently. The copier still has the old one.

Microsoft's dates. In its January 27, 2026 timeline update (revised January 29), the Exchange team says SMTP AUTH with basic authentication keeps working unchanged until the end of December 2026. Then it is disabled by default for existing Microsoft 365 organizations, and admins can still turn it back on. Organizations created after December 2026 don't get it by default. Microsoft says it will announce the final removal date in the second half of 2027.

If the cause is basic authentication, a new password won't fix it. You need a different way of sending.

The free options, honestly

Microsoft documents these in how to set up a multifunction device or application to send email. Each one is free from Microsoft's side, and each has a catch.

1. OAuth on the copier

If the copier's firmware can sign in to Microsoft 365 with OAuth (modern authentication), use it. It's what Microsoft wants and needs nothing extra. The catch: many older models never get it, some need a dealer visit for the firmware, and an admin usually has to approve the copier maker's app in the tenant.

2. Direct send

The copier sends straight to your domain's MX endpoint (like contoso-com.mail.protection.outlook.com) on port 25, with no sign-in. Microsoft's catches: it only delivers to mailboxes in your own organization (scans to a customer or your accountant are rejected), port 25 must be open outbound, it's treated like anonymous internet mail, and Microsoft recommends a static IP for the SPF record. Microsoft also says it is "working on an option to disable Direct Send by default".

3. An SMTP relay connector

An admin creates an inbound connector in Exchange Online that trusts your office's public IP address or a TLS certificate, and the copier sends to the MX endpoint on port 25. It can send to outside addresses. The catches: Microsoft says dynamic IP addresses aren't supported, so you need a static IP that isn't shared with anyone else (or a certificate the copier can present), port 25 must be open, the IP goes in your SPF record, and someone has to keep it right if the IP changes.

4. High Volume Email (HVE)

Microsoft's High Volume Email lists printers and scanners as a use case. The copier signs in to smtp.hve.mx.microsoft on port 587 with an HVE account, using a password or OAuth, and it still works when SMTP AUTH is turned off for the tenant. The catches: internal recipients only, messages up to 10 MB, TLS required, and it's billed pay as you go through an Azure subscription ($42 per million recipients at the time of writing). The cost for a copier is tiny; the Azure billing setup is the work. If security defaults are on, it only accepts OAuth.

5. Turn basic authentication back on

After the December change an admin can switch SMTP AUTH back on for the scanner mailbox. Nothing changes on the copier, but it's temporary (Microsoft will set a final date) and leaves a password-only sign-in open. How, and the trade-offs.

Microsoft's page also points devices that must reach outside recipients at Azure Communication Services Email, which is a paid Azure service with its own setup.

Where Scan Relay fits

Scan Relay is a small Windows program I make for the copiers the free options don't suit: no OAuth firmware, no static IP, scans that go to outside addresses, or nobody available to own a connector and SPF. It runs as a service on an always-on office PC. The copier sends to that PC on the local network (port 25, any username and password), and Scan Relay sends each scan on to Microsoft 365 through Microsoft Graph with OAuth, as the mailbox you signed in with.

Works with any copier or scanner that can scan to email over SMTP, without a firmware update, static IP, connector or DNS change.
Delivers to outside addresses as well as your own staff.
Saves each scan on the PC first and retries if the internet drops.
Limits, so you can decide: it needs a Windows PC that stays on; it sends up to about 3 MB per email (set the copier to split scans at 3 MB); a Microsoft 365 admin approves it once per organization; and the program isn't code-signed yet, so Windows SmartScreen shows a warning the first time. How it handles your mail.

Free for 14 days, then $99 once per office (one PC, any number of copiers). Full refund within 30 days if it doesn't work with your copier.

Scan Relay: free 14-day trial Check if your copier is affected

Questions

Why did scan to email stop working with Office 365?
Most often Microsoft 365 stopped accepting the copier's username-and-password sign-in (basic authentication), or the mailbox password changed. The copier's email log usually shows a 5.7.139, 5.7.57 or 5.7.3 error that tells you which.

Will a firmware update fix it?
Only if the new firmware adds OAuth sign-in for Microsoft 365, or TLS 1.2 for older machines. Ask your dealer whether your exact model gets it.

When does Microsoft turn off SMTP AUTH basic authentication?
Microsoft's January 27, 2026 timeline says it is disabled by default for existing Microsoft 365 organizations at the end of December 2026. Admins can still turn it back on, and Microsoft says it will announce the final removal date in the second half of 2027.

Is direct send a free fix for scan to email?
It's free, but it only delivers to mailboxes in your own Microsoft 365 organization, needs outbound port 25, and Microsoft recommends a static IP for SPF. Scans to outside addresses are rejected.

What does Scan Relay cost?
$99 once per office after a free 14-day trial, covering one PC and any number of copiers. Full refund within 30 days if it does not work with your copier.