In this guide · 8 sections
Short answer
Change the printer's default admin password, update its firmware, keep it off the public internet, and send scans to a dedicated mailbox or cloud folder using a supported Microsoft 365 or Google method. Before the printer is returned or sold, wipe or remove its storage.
Why office printers are a security risk
A modern multifunction printer (MFP) runs its own operating system, stores scanned and printed jobs, holds address books of staff and client email addresses, and often stores a mailbox password for scan-to-email. If an attacker or a curious visitor reaches its admin page with the factory password, they can change where scans are sent, read the address book or use the device as a foothold.
CSA treats printers as part of your IT, not furniture. Its Cyber Essentials mark requirements (version 2025.04) list smart printers among devices that should be in the asset inventory, require all default passwords to be changed, and say IoT devices such as printers that no longer receive updates should be removed or replaced. Our Cyber Essentials checklist covers the rest of the scheme.
Secure printer setup checklist
Work through this once for every printer and scanner, and again whenever one is replaced. Most settings are in the printer's web admin page, reached by typing its IP address into a browser on the office network.
Printer and scanner security checklist
Where to put the printer on the network
In a small office the simplest safe arrangement is to keep printers on the main office network, not the guest Wi-Fi, with a fixed (reserved) IP address so computers can always find them. Guests who need to print can email a document to a staff member.
If your router supports separate networks (VLANs), put printers, CCTV recorders and other office devices on their own segment that staff computers can reach but which cannot reach the internet except for updates. Our guide to CCTV and the PDPA applies the same thinking to camera recorders: fewer paths in, fewer problems.
Scan-to-email vs scan-to-folder
There are two common ways to get scans off the device. Both work; the right choice depends on your setup.
Scan to email
- Staff already know it
- Works with any email system
- No extra software on the printer
- Easy for occasional scans
Scan to cloud folder (SharePoint, OneDrive, Google Drive)
- Scans land in a shared, access-controlled folder
- No attachment copies spread across inboxes
- Often needs the vendor's app or connector
- Better for confidential or high-volume scanning
Scan-to-email copies every document into at least two mailboxes, the sender and recipient, and often many more when forwarded. For identity documents, payroll or client records, a cloud folder with restricted access is usually the safer destination. Many printer makers offer apps or connectors that scan straight to SharePoint, OneDrive or Google Drive.
Fixing scan-to-email with Microsoft 365
Microsoft's guide to sending email from a multifunction device describes the options. The common one, SMTP AUTH with a mailbox username and password, is the one being phased out.
| Method | How it works | Notes for a small office |
|---|---|---|
| SMTP AUTH (client submission) | Printer signs in to a Microsoft 365 mailbox on port 587 | Limited to 10,000 recipients a day and 30 messages a minute. Basic authentication is being retired; use OAuth if the printer supports it. |
| SMTP relay | Printer sends through a Microsoft 365 connector that trusts your static IP or a certificate | Needs a static public IP not shared with others, and port 25 open. |
| Direct Send | Printer sends unauthenticated mail straight to Microsoft 365 | Only to your own domain. Microsoft says most customers do not need it and is working on disabling it by default. |
| High Volume Email | A dedicated Microsoft 365 sending account for internal recipients | Microsoft's suggested alternative for internal-only sending. |
Microsoft's deprecation timeline update of 27 January 2026 says basic-auth SMTP AUTH will be disabled by default for existing tenants at the end of December 2026. If your scanner uses a username and password, plan the change now: check for a firmware update that adds OAuth, switch to scan-to-folder, or set up a relay. Use a dedicated scanning mailbox rather than a staff member's account, so a password reset does not break scanning.
Wiping printers before return, sale or disposal
Leased copiers go back to the vendor, and old printers get sold or scrapped. Many keep copies of jobs on internal storage. Cyber Essentials requires critical or confidential information to be securely wiped, sanitised or destroyed before hardware leaves your control, and recommends physical destruction or disk shredding services when disposing of drives.
Export settings you want to keep
Save the address book and scan profiles if the replacement is the same brand.
Run the manufacturer's secure erase
Most business models have a 'data overwrite', 'HDD sanitise' or 'initialise all data' function in the admin menu.
Remove saved credentials
Delete mailbox, cloud and network folder passwords from the device, then change them at the source.
Ask for a certificate on lease returns
Ask the vendor to confirm in writing that the storage will be wiped or destroyed, or to hand you the drive.
Update your asset list
Mark the device as disposed, with the date and how it was wiped.
Do it yourself or get help?
Changing the admin password and updating firmware is a 20-minute job per printer for anyone comfortable with a web admin page. Scan-to-email changes and network segmentation take more care, because a mistake stops scanning for the whole office.
Our Quick Fix (S$119, one hour remote) covers securing a printer, updating firmware and moving scan-to-email onto a supported Microsoft 365 or Google method. For a sense of wider office IT costs, see our IT support cost guide for Singapore.
Frequently asked questions
A common cause is Microsoft 365 blocking basic authentication for SMTP. Microsoft has announced that basic-auth SMTP AUTH will be disabled by default for existing tenants at the end of December 2026, and new tenants have had SMTP AUTH off by default for years. Use OAuth if the printer supports it, an SMTP relay, or scan to a cloud folder instead.
Yes. CSA's Cyber Essentials mark requirements list smart printers among devices that belong in the asset inventory, require all default passwords to be changed, and say devices such as printers that no longer receive updates should be removed or replaced.
It is better avoided. Scan-to-email creates copies in several mailboxes that are hard to track and delete. For identity documents and other sensitive records, scan to a restricted cloud folder, limit who can open it, and delete copies once you no longer need them under your retention policy.
Many business multifunction printers and copiers have internal hard drives or flash storage that can hold copies of scanned, copied and printed jobs, plus address books and saved passwords. Run the manufacturer's secure erase before returning, selling or scrapping a device, or ask the vendor to destroy the drive.
No. Keep printers on the office network or a dedicated device network that staff computers can reach, and keep guests on a separate network. Never forward router ports to a printer, and switch off remote or cloud management features you do not use.