If your copier scans to email with a Microsoft 365 app password, usually because the mailbox has multi-factor sign-in, it may feel like the modern option. It isn't: as far as Microsoft 365 is concerned, it's still a username and password.
A copier can't answer an MFA prompt. When an organization turned on per-user MFA, the usual workaround was to create an app password for the scanning mailbox and type that into the copier instead of the real password. It's sent to smtp.office365.com exactly like a normal password: SMTP AUTH with basic authentication.
What happens at the end of December 2026
Microsoft has announced that SMTP AUTH with basic authentication is disabled by default for existing organizations at the end of December 2026. Because an app password is basic authentication, my understanding is that copiers using one stop sending at the same time as copiers using a normal password, typically with a 5.7.139 error. What 5.7.139 means.
App passwords were also only ever available with the older per-user MFA, not with security defaults or Conditional Access, so many organizations have been phasing them out already.
What to use instead
OAuth on the copier, if its firmware supports Microsoft 365 modern authentication. Ask your dealer.
A connector or Direct Send, which send without signing in at all. The catches are a static IP for a connector, and internal recipients only for Direct Send. All the options compared.
A local relay.Scan Relay, which I make, runs on an always-on office PC. You sign it in once with the scanning mailbox through Microsoft's own sign-in page, MFA included, and point the copier at the PC on port 25 with no password. It sends through Microsoft Graph with OAuth. Free for 14 days, then $99 once per office.
Microsoft Publisher, Word and PowerPoint are trademarks of Microsoft; PageMaker and InDesign of Adobe; Canva and Affinity of Canva. I'm not affiliated with any of them.
