1. Check what the copier is set to
Type the copier's IP address into a browser on the same network, sign in as administrator, and find the email or SMTP settings (usually under Network, Email, SMTP or Scan to Email). The usual Microsoft 365 setup is:
- SMTP server smtp.office365.com, port 587, STARTTLS (sometimes called TLS) on.
- SMTP authentication on, with a Microsoft 365 email address as the username and its password.
- The "from" address the same as that sign-in mailbox, or one it's allowed to send as.
If it looks like that, the copier relies on basic authentication, which Microsoft is switching off. To confirm, answer three quick questions.
2. Find the actual error
Many copiers keep an email or job log in the same web page; some show an error code on the panel. If you get a message from Microsoft 365, it usually points straight at the cause:
- 5.7.139 … basic authentication is disabled (or SmtpClientAuthentication is disabled): Microsoft 365 no longer accepts password sign-in from the copier. More on 5.7.139.
- 5.7.3 or 5.7.8 authentication unsuccessful: often a changed or expired password, or a mailbox that needs MFA. If the mailbox password changed recently, the copier still has the old one.
- 5.7.60 client does not have permissions to send as this sender: the copier's "from" address doesn't match the mailbox it signs in with.
- A TLS or connection error: often an old copier that can't do the TLS versions Microsoft 365 now requires. A firmware update sometimes helps.
3. Look at the mailbox in Microsoft 365
An admin can check, in the Microsoft 365 admin center under the user's Mail settings, whether "Authenticated SMTP" is allowed for that mailbox, and whether security defaults are on for the organization (they block basic authentication). Sign-in logs in Microsoft Entra usually show the copier's failed attempts too.
4. Decide how it should send from now on
If the cause is basic authentication, re-entering the password won't help for long. The lasting choices are OAuth firmware on the copier, a connector or Direct Send, scanning to a folder, or a local relay. I've compared them here, with the catches for each.
The one I make is Scan Relay: install it on an always-on office PC, sign in once with the mailbox scans should come from, and change the copier's SMTP server from smtp.office365.com to that PC's address, port 25, no SSL. It sends through Microsoft Graph with OAuth. Free for 14 days, then $99 once per office.