1. Find every device that uses SMTP AUTH
Start from the tenants, not the copiers. In each client tenant, the SMTP AUTH clients report in the Exchange admin center (under Reports, Mail flow) and the Entra sign-in logs, filtered to "Authenticated SMTP", usually show which mailboxes still sign in to smtp.office365.com with a password. Scanner mailboxes and service accounts stand out. Cross-check against your copier fleet list or your dealer, and don't forget line-of-business apps that email invoices or alerts the same way.
2. Sort them into three piles
- Supports OAuth with current firmware: schedule the firmware and switch it over. Each copier maker has its own app consent step in the tenant.
- Sends only to internal staff, and the site has a static IP: a connector or Direct Send may be fine, if you're happy owning SPF and port 25 at that site.
- Everything else: older models, dynamic IPs, scans to outside addresses. This is usually the biggest pile.
For a quick read on a single site, the client can answer three quick questions.
3. Make the "everything else" fix repeatable
What you want is one setup that works the same at every site and that a tech can do remotely in a few minutes. A local relay on an always-on PC does that. Scan Relay is the one I make: a Windows service that takes the copier's mail on the LAN (port 25, no auth) and sends it through Microsoft Graph with OAuth. Per site it's:
- Install it on a PC that stays on.
- Sign in with the scanning mailbox. The first time in each tenant, an admin approves it once for the organization.
- Change the copier's SMTP server to that PC's address, port 25, no SSL.
- Send a test scan and enter the license key.
It's $99 per office retail, with a 14-day free trial. For providers there are dealer packs at $29, $25 and $19 per office (10, 25 and 100 offices). Licenses don't expire, and you set your own price to clients.
4. Do it before the end of December
Microsoft has announced the change for the end of December 2026. Switch each site while the old way still works, so a failed test means a callback, not an outage. If you run out of time, re-enabling SMTP AUTH on the scanner mailboxes is a stopgap; here's how and the trade-offs. All the options, compared.