Microsoft is turning off basic authentication for sending email (SMTP AUTH) in Exchange Online at the end of December 2026. Copiers and scanners that send through smtp.office365.com with a username and password will stop sending. Scan Relay is a small Windows program that keeps their scan to email working, and you can try it free for 14 days. It signs in through Microsoft's standard browser sign-in, so it works with MFA and Microsoft's security defaults, with no app passwords to manage.
Everything works for 14 days, no card needed. Then a license is $99 one-time, per office (one PC), with free updates and a 30-day refund if it doesn't work with your copier.
Two things to expect: Windows SmartScreen may warn the first time because the app is new (choose More info, then Run anyway), and a Microsoft 365 admin approves the sign-in once. Both are explained in the questions below.
What's changing
For existing Microsoft 365 (Exchange Online) organizations, Microsoft is disabling SMTP AUTH with basic authentication by default at the end of December 2026. An admin can turn it back on for a while, and Microsoft says it will announce the final removal date in the second half of 2027. New organizations created after December 2026 won't have it at all.
What stops working
Anything that sends email through smtp.office365.com with a username and password:
Older copiers and scanners, for scan to email.
Line-of-business apps that email invoices, reports or alerts.
The error usually says basic authentication is disabled, for example 5.7.139.
How Scan Relay works
LeDuc Scan Relay is a small Windows service you install on any PC in the office that stays on.
Download it and double-click it on that PC. It installs itself and opens a setup page.
Sign in with the Microsoft 365 account scans should come from. That's Microsoft's own sign-in page; Scan Relay never sees the password.
Point the copier's scan to email at that PC instead of smtp.office365.com. The copier keeps sending plain SMTP, the way it does now.
The relay sends the mail on to Microsoft 365 using Microsoft's modern sign-in (OAuth and Microsoft Graph).
There's no cloud relay in the middle. Mail goes straight from your network to your Microsoft 365, never through my servers. For IT: how Scan Relay handles your mail, covering the permissions it asks for, where the sign-in is stored, what the installer changes and how to remove it.
The free options
If you have IT help, there are free ways around this: a Microsoft 365 connector that relays mail from your office's static IP address, or turning basic authentication back on for now (which only lasts until Microsoft removes it for good). Scan Relay is for offices that want scan to email to just keep working without that.
Download it and use everything free for 14 days, no card needed. After that, scans pause until you enter a license key. Buying a license shows the key straight away; paste it into the setup page at http://localhost:2526.
What does a license cover?
One PC in one office, with as many copiers and scanners as you like pointed at it. It is a one-time payment with free updates.
What if I want my money back?
Email tyler@leducsystems.com within 30 days for a full refund if it doesn't work with your copier.
What do I set on the copier?
The setup page shows it: the PC's address as the SMTP server, port 25, no SSL/TLS and no authentication. If the copier insists on a username and password, any will do, because only devices on your own network can send to it. Also set the copier's maximum email size, or "split email by size", to 3 MB.
How big can a scan be?
About 3 MB per email, which is the most Microsoft 365 accepts in one message sent with the send-only permission Scan Relay uses. Most copiers can split a long scan into several emails: set the maximum email size, or "split email by size", to 3 MB (try 2 MB if a scan still fails). A scan that's too big isn't lost: it stays in Scan Relay's failed folder and the error is in its log. Sending larger single emails needs an option that isn't released yet.
What if the internet drops?
Every scan is saved on the PC before the copier is told it was sent, then sent on as soon as Microsoft 365 is reachable. Nothing is lost.
Who isn't it for?
Offices with IT help that can set up a connector with a static IP, which is free. Copiers that already support Microsoft 365's modern sign-in. Offices with nothing that sends through smtp.office365.com with a password. And offices without a Windows PC that stays on, since the relay runs on one.
Do you see my email or scans?
No. The relay runs on your PC and sends straight to your Microsoft 365. Your scans and email never pass through my servers. Payment is handled by Stripe, which gives me your name and email for the receipt; your license key appears on this page the moment you pay. I never see your card.
Microsoft says it needs admin approval. What do I do?
Microsoft asks a Microsoft 365 admin to approve apps from new publishers like me. Have your admin (in a small office, usually the owner or whoever set up Microsoft 365) sign in once and tick Consent on behalf of your organization. After that, anyone can sign Scan Relay in with the mailbox scans should come from. Scan Relay only asks to send mail and read the signed-in account's name.
Windows says the app is unrecognised. Is it safe?
Scan Relay is new, so Windows SmartScreen may warn you the first time. Click More info, then Run anyway. It is made by LeDuc Systems LLC, and you can email me with any question before you run it.
Not affiliated with Microsoft. Microsoft 365 and Exchange Online are trademarks of Microsoft. Questions: tyler@leducsystems.com.
