Xerox scan to email with Microsoft 365 after SMTP AUTH is turned off

If your Xerox sends scans through smtp.office365.com with a mailbox password, it stops when Microsoft 365 turns off basic authentication. On most models you won't see a clear message, just a send error or scans that never arrive. Here are your choices.

Microsoft's dates. In its January 27, 2026 timeline update (revised January 29), the Exchange team says SMTP AUTH with basic authentication keeps working unchanged until the end of December 2026. Then it is disabled by default for existing Microsoft 365 organizations, and admins can still turn it back on. Organizations created after December 2026 don't get it by default. Microsoft says it will announce the final removal date in the second half of 2027.

Check your Xerox

In the Embedded Web Server (the copier's IP address in a browser), log in as admin and open Properties, then Connectivity, then Setup, then SMTP (on some models Apps, then Email).

If the SMTP server is smtp.office365.com (usually port 587) and SMTP authentication uses a Microsoft 365 email address and password, this change affects it. Menu names vary by model and firmware; your dealer can confirm over the phone. The copier's job or email log may show 5.7.139 or 5.7.57.

What Xerox offers

Some AltaLink and VersaLink models support OAuth with current firmware, and Xerox offers the Connect App for Exchange Online for ConnectKey devices. Ask your dealer whether your exact model and firmware can do it; if it can, that's the cleanest answer, with no extra software.

The free options, honestly

Microsoft documents these in how to set up a multifunction device or application to send email. Each one is free from Microsoft's side, and each has a catch.

1. OAuth on the copier

If the copier's firmware can sign in to Microsoft 365 with OAuth (modern authentication), use it. It's what Microsoft wants and needs nothing extra. The catch: many older models never get it, some need a dealer visit for the firmware, and an admin usually has to approve the copier maker's app in the tenant.

2. Direct send

The copier sends straight to your domain's MX endpoint (like contoso-com.mail.protection.outlook.com) on port 25, with no sign-in. Microsoft's catches: it only delivers to mailboxes in your own organization (scans to a customer or your accountant are rejected), port 25 must be open outbound, it's treated like anonymous internet mail, and Microsoft recommends a static IP for the SPF record. Microsoft also says it is "working on an option to disable Direct Send by default".

3. An SMTP relay connector

An admin creates an inbound connector in Exchange Online that trusts your office's public IP address or a TLS certificate, and the copier sends to the MX endpoint on port 25. It can send to outside addresses. The catches: Microsoft says dynamic IP addresses aren't supported, so you need a static IP that isn't shared with anyone else (or a certificate the copier can present), port 25 must be open, the IP goes in your SPF record, and someone has to keep it right if the IP changes.

4. High Volume Email (HVE)

Microsoft's High Volume Email lists printers and scanners as a use case. The copier signs in to smtp.hve.mx.microsoft on port 587 with an HVE account, using a password or OAuth, and it still works when SMTP AUTH is turned off for the tenant. The catches: internal recipients only, messages up to 10 MB, TLS required, and it's billed pay as you go through an Azure subscription ($42 per million recipients at the time of writing). The cost for a copier is tiny; the Azure billing setup is the work. If security defaults are on, it only accepts OAuth.

5. Turn basic authentication back on

After the December change an admin can switch SMTP AUTH back on for the scanner mailbox. Nothing changes on the copier, but it's temporary (Microsoft will set a final date) and leaves a password-only sign-in open. How, and the trade-offs.

Microsoft's page also points devices that must reach outside recipients at Azure Communication Services Email, which is a paid Azure service with its own setup.

Where Scan Relay fits

Scan Relay is a small Windows program I make for the copiers the free options don't suit: no OAuth firmware, no static IP, scans that go to outside addresses, or nobody available to own a connector and SPF. It runs as a service on an always-on office PC. The copier sends to that PC on the local network (port 25, any username and password), and Scan Relay sends each scan on to Microsoft 365 through Microsoft Graph with OAuth, as the mailbox you signed in with.

Works with any copier or scanner that can scan to email over SMTP, without a firmware update, static IP, connector or DNS change.
Delivers to outside addresses as well as your own staff.
Saves each scan on the PC first and retries if the internet drops.
Limits, so you can decide: it needs a Windows PC that stays on; it sends up to about 3 MB per email (set the copier to split scans at 3 MB); a Microsoft 365 admin approves it once per organization; and the program isn't code-signed yet, so Windows SmartScreen shows a warning the first time. How it handles your mail.

Free for 14 days, then $99 once per office (one PC, any number of copiers). Full refund within 30 days if it doesn't work with your copier.

Scan Relay: free 14-day trial Check if your copier is affected

Pointing the Xerox at Scan Relay

Install Scan Relay on a PC that stays on, and sign in with the Microsoft 365 mailbox scans should come from.
In the Xerox's SMTP settings, change the server from smtp.office365.com to the PC's address (the setup page shows it), port 25, SSL/TLS off. Any username and password will do. If the Xerox won't send without SSL/TLS, tick "Accept SSL/TLS from copiers" on Scan Relay's setup page instead.
Set the maximum email size, or "split email by size", to 3 MB.
Send a test scan.

The Xerox address book, scan buttons and destinations stay as they are. Only the SMTP server changes. More Xerox detail is in my Xerox and Microsoft 365 guide.

Questions

Will my Xerox stop scanning to email in 2027?
If it signs in to smtp.office365.com with a mailbox password, yes: Microsoft disables basic authentication by default at the end of December 2026. A Xerox using OAuth, a connector or direct send is not affected.

Does my Xerox support OAuth for Microsoft 365?
It depends on the model and firmware. Some AltaLink and VersaLink models support OAuth with current firmware, and Xerox offers the Connect App for Exchange Online for ConnectKey devices.

Is direct send a free fix for scan to email?
It's free, but it only delivers to mailboxes in your own Microsoft 365 organization, needs outbound port 25, and Microsoft recommends a static IP for SPF. Scans to outside addresses are rejected.

What does Scan Relay cost?
$99 once per office after a free 14-day trial, covering one PC and any number of copiers. Full refund within 30 days if it does not work with your copier.