Your Office Scanner May Stop Emailing Scans After December

On January 27, 2026, Microsoft published an updated timeline for retiring Basic authentication on SMTP AUTH in Exchange Online. Until December 2026 nothing changes. At the end of December 2026, it is disabled by default for existing Microsoft 365 tenants. Administrators can still turn it back on, and Microsoft says it will announce the final removal date in the second half of 2027.

In plain terms: a device or program that sends email by typing a Microsoft 365 username and password into smtp.office365.com may stop sending on the first business day of January. The most common one in an office is the copier or scanner that emails scans.

Who This Hits

Anything that sends mail through Microsoft 365 with a stored password. In small offices that usually means:

• Copiers and multifunction printers with scan-to-email
• Accounting, practice-management or ERP software that emails invoices, statements or reminders
• Alarm panels, camera recorders, UPS units and network devices that email alerts
• Website forms and older plugins set up to send through your Microsoft 365 mailbox
• Scripts and scheduled tasks someone set up years ago

It does not affect people reading and sending email in Outlook or on their phones.

The Ten-Minute Check

1. Open the copier's settings page (type its IP address into a browser) or ask your copier dealer for the setup sheet. Find the email or SMTP section.
2. Look at three fields. Server: smtp.office365.com. Port: 587 (sometimes 25). Authentication: a username such as scanner@yourcompany.com and a password. If all three match, the device uses SMTP AUTH with Basic authentication and is affected.
3. If the server is an address ending in mail.protection.outlook.com and no password is entered, the device uses Direct Send or a relay. Those are different methods, and this change does not turn them off.
4. Repeat for each program on the list above. The setting is usually called SMTP, outgoing mail, or email server.

One more clue: Microsoft notes that Basic SMTP AUTH isn't compatible with Security defaults in Microsoft Entra ID. If someone switched off security defaults so the scanner would keep working, that is worth fixing for its own sake.

Four Ways to Fix It

Microsoft's guide for devices and applications lays out the options. In order of what we usually try first:

1. Update the device so it signs in with Microsoft (OAuth)

Many newer copiers and business programs can sign in to Microsoft 365 the modern way after a firmware or software update. Ask your copier dealer or vendor one question: does this model support OAuth or "modern authentication" for Microsoft 365? If yes, this is the cleanest fix. Nothing else in your setup changes.

2. Use an SMTP relay connector

Microsoft 365 can accept mail from your office's static public IP address through a connector, so the device sends on port 25 with no password stored on it. It needs a static IP from your internet provider and an update to your SPF record so receiving servers trust the mail. This is the usual answer for older copiers that will never get OAuth.

3. Use Direct Send, for internal mail only

If the scanner only ever emails your own staff, it can send straight to your Microsoft 365 mail address without signing in. It cannot send to outside addresses, and Microsoft notes the mail can be filtered as suspicious, so it also needs an SPF entry.

4. Move the bulk senders to a sending service

For software that sends a lot of mail, Microsoft now points to High Volume Email for internal recipients and Azure Communication Services Email when mail goes to customers. Your software vendor may also offer its own sending service.

Turning Basic authentication back on in January is a fifth option, and it works for now. Treat it as a few months' grace, not a fix, because Microsoft has said a final removal date is coming.

What We'd Do Before Christmas

1. Make the list: every device and program that sends mail, with the method each one uses.
2. Call the copier dealer now. Firmware updates and service visits book up in December.
3. Pick a fix for each item, starting with OAuth where it exists.
4. If any fix needs a relay connector, confirm your static IP and update SPF before switching.
5. Send a test scan to an inside and an outside address after each change.
6. Write down the admin password and settings for each device somewhere the next person can find them.

When to Call Someone

Changing one copier setting is a reasonable do-it-yourself job. Get help if:

• You have more than a couple of devices or programs sending mail and no list of them.
• A fix needs a connector or SPF change and nobody is sure who manages your DNS.
• Your SPF record is already long. Each sender added to it counts against a lookup limit, and going over breaks it.
• The program that sends invoices or statements is on the list. A quiet failure there costs real money.

Microsoft is also retiring an older mailbox connection called EWS, with a final cutoff of April 1, 2027. Our EWS post covers what that breaks. For help with either, call (330) 305-2750.

Common questions