Is this domain on Microsoft 365?

Check all your clients at once

For IT providers and copier dealers: paste up to 200 client domains, one per line or separated by commas. You get a table and a CSV to work from.

The lookups go from your browser straight to Cloudflare's public DNS (Google's if Cloudflare doesn't answer) and to Microsoft's public sign-in service. The domains you type are never sent to me, and nothing is stored.

What this tells you, and what it doesn't

DNS shows where a domain's email goes. If its MX records point to Exchange Online (*.mail.protection.outlook.com), or its SPF record includes spf.protection.outlook.com, the office's mail is on Microsoft 365. When mail passes through a filtering service like Mimecast or Proofpoint first, the MX hides Microsoft 365, so I also look at SPF and ask Microsoft whether the domain is registered to a Microsoft tenant; if only the tenant points to Microsoft, the answer is "possibly".

What DNS can't show is how each copier signs in. A domain on Microsoft 365 is exposed: any device there that sends through smtp.office365.com with a username and password stops at the end of December. Devices that already use OAuth, or send through a connector or direct send, keep working. For the per-device answer, use the report below, or answer three questions from one copier's settings.

Find the devices that will stop

You need admin access to the client's Microsoft 365. Two ways to look:

1. The SMTP AUTH clients report. In the Exchange admin center, go to Reports, Mail flow, then SMTP AUTH clients report. The "Messages sent using SMTP Auth" list shows each sender address and its Authentication Protocol: Basic Auth is a device or app that signs in with a password, and those are the ones that stop. It shows the last 7 days by default; widen the date range (up to 90 days) so a copier that scans once a week shows up. Export gives you a CSV.
2. Exchange Online PowerShell. See whether SMTP AUTH is turned off for the whole organization:

   Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled

   Then for the mailbox the copier signs in with:

   Get-CASMailbox -Identity scanner@clientdomain.com | Format-List SmtpClientAuthenticationDisabled

   False means SMTP AUTH is allowed for that mailbox, True means it's turned off, and blank means the mailbox follows the organization setting. These show whether SMTP AUTH is allowed, not whether a device is using it; the report shows that.

Microsoft has said that at the end of December 2026 basic authentication for SMTP AUTH is disabled by default in existing organizations, that admins can still turn it back on, and that it will announce the final removal date in the second half of 2027. Organizations created after December 2026 won't have it at all. Microsoft has moved these dates before, so check its current announcement.

Fixing the ones that stop

Where the copier supports Microsoft 365 modern sign-in (OAuth) after a firmware update, that's the cleanest fix. For the rest, the options compared covers connectors, direct send and relays. Scan Relay is the relay I make: a Windows service on an office PC that takes the copier's mail the old way and sends it on through Microsoft Graph with OAuth. If you look after many offices, there are dealer packs and a rollout plan.