Scan to Email Stopped Working With Microsoft 365? The December 2026 Change, and 4 Fixes
Why will scan to email stop working with Microsoft 365?
If scan to email stopped working, or is about to, it is because most office copiers send scans through Microsoft 365 by signing in with a plain username and password, and Microsoft is switching that kind of sign-in off. At the end of December 2026, Exchange Online disables Basic authentication for SMTP AUTH by default in existing Microsoft 365 tenants. A copier set up that way will scan, show the job as sent, and nothing will arrive. Microsoft confirmed the date in its updated deprecation timeline.
There is a short grace period. An administrator can turn Basic authentication back on after December, and Microsoft will announce a final shut-off date in the second half of 2027. That buys time, not a fix. Tenants created after December 2026 will not have the option at all.
If your scans have already stopped and the copier or the bounce message shows 550 5.7.30 Basic authentication is not supported for Client Submission or 535 5.7.139, this is your problem, and the fixes are below.
How do I know if my copier is affected?
Open the copier’s web page (type its IP address into a browser on the office network) and find the scan-to-email or SMTP settings. Then compare:
- Affected: the server is smtp.office365.com, the port is 587, and there is a username and password for a mailbox such as scans@ or the office manager’s address.
- Not affected by this change: the server ends in mail.protection.outlook.com on port 25 with no password. That is Direct Send or an SMTP relay, which work differently (more on those below).
- Probably fine: the copier shows a Microsoft 365 or OAuth sign-in option and it is the one in use.
Copiers are not the only thing that sends this way. Check anything else that emails out with a saved password: a fax-to-email box, an older accounting or practice-management program, appointment reminders, a security camera recorder or an alarm panel.
1. Check for a firmware update that adds Microsoft 365 sign-in
The clean fix is for the copier to sign in the modern way (OAuth), the same way Outlook does. Several major copier makers have added this to newer models through firmware updates, usually shown as a Microsoft 365 or OAuth 2.0 option in the email settings. Ask your copier dealer or check the maker’s support page for your exact model. If the copier is leased, the dealer should do this at no charge as part of service. If the model is too old to get it, skip to the next options.
2. Scan to a folder or to OneDrive instead
For many offices, email was never the right place for scans anyway. Most copiers can scan to a shared folder on the network, and many can scan straight to OneDrive or SharePoint. For a tax office or a medical practice, that is often the better design: client documents land in one controlled place instead of sitting as attachments in someone’s mailbox.
3. Send scans through an SMTP relay connector
Microsoft 365 can accept mail from your office as a trusted sender if you set up an inbound connector that recognizes your office by its public IP address or by a certificate. The copier then sends to your domain’s mail.protection.outlook.com address on port 25, with no password. Microsoft documents this in How to set up a multifunction device to send email.
The catch: the IP version needs a static public IP address that only your office uses. Many small offices in Central Florida are on a business internet plan with a dynamic address, and those addresses are often on spam blocklists that Microsoft checks. We have seen a copier on that kind of connection rejected outright, even with the address added to Microsoft’s allow list. Ask your internet provider whether your IP is static before you go this way.
4. Use High Volume Email if scans only go to staff
If the copier only ever sends to people inside your company, Microsoft now recommends High Volume Email for Microsoft 365. It gives the copier its own sending account that supports modern sign-in, and it cannot send to outside addresses. For offices that need to scan to clients as well, Microsoft points to its Azure Communication Services email instead, or you can use a third-party email relay service with your domain’s SPF and DKIM records updated to match.
What about Direct Send?
Direct Send lets the copier drop mail into Microsoft 365 with no sign-in at all, and only to your own staff. It still works, but Microsoft’s own documentation says most customers don’t need it and that it is working on an option to turn it off by default, because attackers use the same path to send fake internal email. It also fails if your office IP is on a blocklist. We don’t recommend setting it up new in 2026.
How do I test it properly?
Most copiers have a Test or Verify button on the email settings page. On many models it only checks that the copier can connect and sign in. It does not send a message. A passing test does not mean scans arrive. The only real test is to scan a page to an outside address and to an inside one, and open both. If you manage Microsoft 365, the message trace in the Exchange admin center will show whether the scan arrived and from which IP address.
Why fix it now and not in January?
Because January is when nobody has time. Tax offices start scanning W-2s and IDs the first week of the year, medical and dental offices are re-verifying insurance cards, and the change lands over the holidays. If you find out from a client who never got their documents, you are fixing it in the busiest week of the year. An afternoon in November avoids that.
While you are in the settings, two more checks are worth doing: whether the mailbox the copier uses still has a password nobody remembers, and whether anyone can send email pretending to be your company. Our free email spoofing check answers the second in ten seconds.
Want Us to Sort Out Your Scanners?
iTech Plus fixes scan-to-email and Microsoft 365 mail flow for offices across Polk and Osceola counties, in English and Spanish. We check every copier and app that sends mail, choose the option that fits your internet connection, and test with a real scan. See our Microsoft 365 management service, book a free IT assessment, or call (321) 221-7117 or email info@itechplus.co.
Este artículo también está disponible en español.
