If a copier, scanner or old app sends email through Microsoft 365 and gets "535 5.7.139 Authentication unsuccessful, basic authentication is disabled", Microsoft 365 is refusing its username and password. Here is what that means and what you can do about it.
The device is signing in to smtp.office365.com with a plain username and password (SMTP AUTH with basic authentication), and your Microsoft 365 organization no longer accepts that. The password is usually fine. It's the way of signing in that's turned off.
The same 5.7.139 code comes with a few different endings. The ones I've seen documented are roughly:
"basic authentication is disabled": basic authentication is off for the organization or the mailbox.
"SmtpClientAuthentication is disabled for the Tenant" or "for the Mailbox": SMTP AUTH itself is switched off, organization-wide or for that one mailbox.
"user is locked by your organization's security defaults policy": security defaults are on, which blocks basic authentication.
Why copiers hit it
Most office copiers and MFPs were set up years ago to scan to email through smtp.office365.com, port 587, with a mailbox's email address and password. Microsoft has announced that for existing Microsoft 365 organizations it disables SMTP AUTH with basic authentication by default at the end of December 2026. An admin can turn it back on for a while, and Microsoft says it will announce the final removal date in the second half of 2027. So you'll see this error more and more from January 2027, and in some organizations sooner, if an admin or security defaults already turned it off.
On the copier itself you usually won't see "5.7.139". Most models just show a send error, or the scan never arrives. The full message is sometimes in the copier's job log or email log, depending on the model.
Your options
Switch the copier to OAuth (Microsoft's modern sign-in), if its firmware supports it. Many newer models do after an update; ask your dealer. That's the cleanest answer.
Turn SMTP AUTH back on for that mailbox, if your organization still allows it. It buys time, not a permanent answer. How that works and what it costs you.
Send without signing in, through a Microsoft 365 connector (needs a static public IP) or Direct Send (internal recipients only). Microsoft's options compared.
Scan to a folder or OneDrive instead of email, if your staff can live with it.
Put a local relay in between.Scan Relay, which I make, runs on an always-on office PC. The copier sends to that PC on port 25 with no sign-in, and Scan Relay sends each scan on to Microsoft 365 through Microsoft Graph with OAuth. No firmware update, static IP or DNS changes. Free for 14 days, then $99 once per office.
Not sure it's your copier?
If you haven't seen the error yet and want to know whether you will, answer three quick questions from the copier's email settings.
Microsoft Publisher, Word and PowerPoint are trademarks of Microsoft; PageMaker and InDesign of Adobe; Canva and Affinity of Canva. I'm not affiliated with any of them.
