SMTP AUTH deprecation in December 2026: copiers and MFPs

Microsoft is turning off password sign-in for SMTP in Exchange Online. Copiers and multifunction printers that scan to email through smtp.office365.com are the largest group of devices still using it.

Microsoft's dates. In its January 27, 2026 timeline update (revised January 29), the Exchange team says SMTP AUTH with basic authentication keeps working unchanged until the end of December 2026. Then it is disabled by default for existing Microsoft 365 organizations, and admins can still turn it back on. Organizations created after December 2026 don't get it by default. Microsoft says it will announce the final removal date in the second half of 2027.

What exactly changes

What's affected: SMTP AUTH client submission with basic authentication, meaning a device that signs in to smtp.office365.com (port 587 or 25) with a mailbox address and password.
What isn't: SMTP AUTH with OAuth keeps working. Direct send, SMTP relay connectors and High Volume Email are separate paths and aren't part of this change.
Existing organizations: basic authentication is disabled by default at the end of December 2026; an admin can turn it back on.
New organizations created after December 2026: not available by default.
Final removal: date to be announced by Microsoft in the second half of 2027.

Microsoft has moved these dates before (an earlier plan targeted March to April 2026), so check the Exchange team's post for any later update.

Is your copier affected?

If its SMTP server is smtp.office365.com and it signs in with a mailbox address and password, yes. Copiers set up to use OAuth, or sending through a connector, direct send or another mail server, aren't. Three quick questions will tell you. In the Exchange admin center, Reports, Mail flow, the SMTP AUTH clients report lists every account still signing in this way.

A checklist for before January

List every copier, scanner and app that emails through Microsoft 365, and the mailbox each uses.
For each, ask the dealer whether current firmware supports Microsoft 365 OAuth.
Decide per device: OAuth, direct send, connector, HVE, or a relay (below).
Switch and send a test scan while basic authentication still works, so a failed test is a fallback, not an outage.
Set the copier's maximum email size to match the new path.

The free options, honestly

Microsoft documents these in how to set up a multifunction device or application to send email. Each one is free from Microsoft's side, and each has a catch.

1. OAuth on the copier

If the copier's firmware can sign in to Microsoft 365 with OAuth (modern authentication), use it. It's what Microsoft wants and needs nothing extra. The catch: many older models never get it, some need a dealer visit for the firmware, and an admin usually has to approve the copier maker's app in the tenant.

2. Direct send

The copier sends straight to your domain's MX endpoint (like contoso-com.mail.protection.outlook.com) on port 25, with no sign-in. Microsoft's catches: it only delivers to mailboxes in your own organization (scans to a customer or your accountant are rejected), port 25 must be open outbound, it's treated like anonymous internet mail, and Microsoft recommends a static IP for the SPF record. Microsoft also says it is "working on an option to disable Direct Send by default".

3. An SMTP relay connector

An admin creates an inbound connector in Exchange Online that trusts your office's public IP address or a TLS certificate, and the copier sends to the MX endpoint on port 25. It can send to outside addresses. The catches: Microsoft says dynamic IP addresses aren't supported, so you need a static IP that isn't shared with anyone else (or a certificate the copier can present), port 25 must be open, the IP goes in your SPF record, and someone has to keep it right if the IP changes.

4. High Volume Email (HVE)

Microsoft's High Volume Email lists printers and scanners as a use case. The copier signs in to smtp.hve.mx.microsoft on port 587 with an HVE account, using a password or OAuth, and it still works when SMTP AUTH is turned off for the tenant. The catches: internal recipients only, messages up to 10 MB, TLS required, and it's billed pay as you go through an Azure subscription ($42 per million recipients at the time of writing). The cost for a copier is tiny; the Azure billing setup is the work. If security defaults are on, it only accepts OAuth.

5. Turn basic authentication back on

After the December change an admin can switch SMTP AUTH back on for the scanner mailbox. Nothing changes on the copier, but it's temporary (Microsoft will set a final date) and leaves a password-only sign-in open. How, and the trade-offs.

Microsoft's page also points devices that must reach outside recipients at Azure Communication Services Email, which is a paid Azure service with its own setup.

Where Scan Relay fits

Scan Relay is a small Windows program I make for the copiers the free options don't suit: no OAuth firmware, no static IP, scans that go to outside addresses, or nobody available to own a connector and SPF. It runs as a service on an always-on office PC. The copier sends to that PC on the local network (port 25, any username and password), and Scan Relay sends each scan on to Microsoft 365 through Microsoft Graph with OAuth, as the mailbox you signed in with.

Works with any copier or scanner that can scan to email over SMTP, without a firmware update, static IP, connector or DNS change.
Delivers to outside addresses as well as your own staff.
Saves each scan on the PC first and retries if the internet drops.
Limits, so you can decide: it needs a Windows PC that stays on; it sends up to about 3 MB per email (set the copier to split scans at 3 MB); a Microsoft 365 admin approves it once per organization; and the program isn't code-signed yet, so Windows SmartScreen shows a warning the first time. How it handles your mail.

Free for 14 days, then $99 once per office (one PC, any number of copiers). Full refund within 30 days if it doesn't work with your copier.

Scan Relay: free 14-day trial Check if your copier is affected

Questions

When does Microsoft turn off SMTP AUTH basic authentication?
Microsoft's January 27, 2026 timeline says it is disabled by default for existing Microsoft 365 organizations at the end of December 2026. Admins can still turn it back on, and Microsoft says it will announce the final removal date in the second half of 2027.

Does the December 2026 change affect OAuth?
No. It turns off basic (username and password) authentication for SMTP AUTH. Devices that sign in with OAuth keep working, unless an admin turns SMTP AUTH off completely.

Can I just turn basic authentication back on?
For now, yes: Microsoft says admins can re-enable it after December 2026. It is a stopgap until the final removal date, which Microsoft plans to announce in the second half of 2027.

Can a copier use High Volume Email?
Yes, Microsoft lists printers and scanners as an HVE use case. It sends to internal recipients only, up to 10 MB per message, and is billed pay as you go through an Azure subscription.

What does Scan Relay cost?
$99 once per office after a free 14-day trial, covering one PC and any number of copiers. Full refund within 30 days if it does not work with your copier.