1. OAuth on the copier
Newer copiers can sign in to Microsoft 365 with OAuth (modern authentication) after a firmware update, usually after an admin approves the copier maker's app in your tenant.
- Good: no extra hardware or software, and it's what Microsoft wants. If your copier supports it, start here.
- Catches: many older models never get it. Some need a dealer visit for the firmware. Sign-in tokens can expire, and the copier may need signing in again now and then.
2. An SMTP relay connector
An admin creates an inbound connector in Exchange Online that trusts mail coming from your office's public IP address (or a certificate). The copier sends to your domain's MX endpoint (something like yourdomain-com.mail.protection.outlook.com) on port 25 with no password.
- Good: free, and it can send to outside addresses as well as your own.
- Catches: needs a static public IP, which many small offices don't have. Your internet provider must not block outgoing port 25. You need to add that IP to your SPF record, and someone has to set it up and keep it right when the IP changes.
3. Direct Send
The copier sends straight to the same MX endpoint on port 25 with no sign-in and no connector.
- Good: free, and nothing to install.
- Catches: it only delivers to mailboxes in your own organization, so no scanning to a customer or your accountant. Outgoing port 25 must be open. Without SPF set up it can land in junk. And because it's been abused for spoofing, Microsoft added a setting that lets admins reject Direct Send entirely; if your organization turns that on, it stops.
4. High Volume Email (HVE)
Microsoft's High Volume Email service for Exchange Online is meant for apps and devices sending large amounts of mail to people inside your organization.
- Good: made by Microsoft for this kind of sender.
- Catches: internal recipients only, it has its own limits and setup, and it's been changing (it was in preview for a long time). Microsoft has published separate timelines for how long HVE itself accepts basic authentication, so check its current documentation before you rely on it for a copier with no OAuth.
5. Turn basic authentication back on
Microsoft has said admins can re-enable SMTP AUTH after the December 2026 change, for a while. How, and the downsides.
- Good: quick, and nothing changes on the copier.
- Catches: temporary: Microsoft says it will announce a final removal date in the second half of 2027. It also leaves a password-only sign-in open on that mailbox.
6. A local relay
A small program on an always-on office PC takes the copier's email on the local network the old way and sends it on to Microsoft 365 with OAuth. Free open-source relays exist if you have IT help to set one up. Scan Relay is mine: a Windows service that sends through Microsoft Graph.
- Good: works with any copier that can scan to email, old or new. No static IP, no connector, no DNS changes, and it can send to outside addresses. The copier never holds a Microsoft password.
- Catches: you need a Windows PC that stays on, and scans only flow while it's running. Scan Relay costs $99 once per office after a 14-day free trial.
So which one?
If the copier supports OAuth, use it. If you have a static IP and IT help, a connector is free. If every scan goes to your own staff, Direct Send may do. For older copiers on a normal office connection, a local relay is usually the least work. Not sure where your copier stands? answer three quick questions.