Scan-to-Email Stopped Working With Microsoft 365? (SMTP AUTH)

Why scan-to-email stopped working: the common causes

Start with the error on the printer's screen or its web admin page, and the address the scans were sent from. Most failures match one of these.

Our guide to email bounce-back errors explains how to read the full error codes if the printer emails one back.

Microsoft's SMTP AUTH basic authentication timeline

Many printers send through smtp.office365.com on port 587 with a username and password. That is "client SMTP submission with basic authentication". Microsoft's updated deprecation timeline, published 27 January 2026, sets out the dates:

Quick checks before you change anything

If scanning stopped recently and the deadline has not passed, the fix is often small.

1. 1

   Sign in to the sending mailbox

   Log in on the web with the account the printer uses. If the password has expired or it asks for MFA set-up, that explains the failure.

2. 2

   Check security defaults and policies

   Microsoft says client SMTP submission with basic authentication is not compatible with security defaults in Microsoft Entra ID. If someone recently turned them on, basic-auth scanning will fail.

3. 3

   Check SMTP AUTH on the mailbox

   In the Microsoft 365 admin centre, open the user, go to Mail, Manage email apps, and see whether Authenticated SMTP is ticked. It can also be disabled for the whole tenant.

4. 4

   Check the printer's SMTP settings

   Server smtp.office365.com, port 587, STARTTLS or TLS on, and the full email address as the username. Microsoft says to use the DNS name, not an IP address.

5. 5

   Update the printer firmware

   Older firmware may lack TLS 1.2 or OAuth support. Some printer makers have added OAuth support for Microsoft 365 in newer firmware, so check your model's release notes.

Do not turn off security defaults or MFA for the whole company to make a printer work. Fix the printer instead; our Microsoft 365 security checklist explains why those settings matter.

The three supported options for printers and scanners

Microsoft's guide to setting up a multifunction device or application to send email describes the methods. For a small office, these are the realistic choices.

Microsoft's own page says most customers do not need Direct Send and recommends it only for advanced customers willing to manage it properly. It also notes that a device defaulting to port 465 does not support the TLS versions needed for SMTP AUTH.

Setting up an SMTP relay connector

For many offices, the relay connector is the most durable fix because it does not depend on a mailbox password or the printer's OAuth support. The outline:

1. Confirm your office internet has a static public IP address (ask your ISP).
2. In the Exchange admin centre, go to Mail flow, Connectors, and add a connector from "Your organization's email server" to Office 365, identified by that IP or a certificate.
3. Point the printer to your MX endpoint, which looks like yourdomain-com.mail.protection.outlook.com, on port 25 with TLS.
4. Add the office IP to your domain's SPF record so scans are not marked as spam.
5. Send a test scan to an internal and an external address.

Check that your ISP does not block outbound port 25. If scans arrive but land in junk, our guide to Outlook emails going to spam covers SPF and DKIM.

Reject Direct Send and the 550 5.7.68 error

Microsoft introduced a Reject Direct Send setting to stop attackers sending spoofed mail that appears to come from your own domain. When an administrator turns it on, anonymous messages using your domain are rejected with 550 5.7.68 TenantInboundAttribution.

That is a good security change, but it also blocks printers using Direct Send. The fix is not to turn the setting off. Microsoft's guidance is to create a partner connector that matches the device's certificate or IP, so the printer's mail is attributed to your organisation. In practice, that means moving the printer to the relay connector method above.

Do it yourself or get help?

If the cause is a changed password or an outdated setting on the printer, a few minutes in the printer's web page fixes it. Moving to OAuth or a relay connector takes admin access to Microsoft 365, the printer's admin page and, for a connector, knowledge of your office IP.

A single printer is usually within a Quick Fix (S$119 for up to one hour of remote work, with a written summary), and we quote first if it needs longer. If your Microsoft 365 set-up itself needs sorting out, our Business Email Setup (S$249) sets up Microsoft 365 or Google Workspace on your domain with SPF, DKIM and DMARC, in your own account.