Set up a multifunction printer, scanner or business application to send email through Microsoft 365. This guide explains the three methods Microsoft supports (SMTP AUTH on smtp.office365.com port 587, direct send, and SMTP relay with a connector), how security defaults and the retirement of basic authentication affect them, and which one to choose.
Before you start
- You'll need access to the printer's or application's email (SMTP) settings, usually through its web admin page, and a Microsoft 365 admin account.
- Find out whether the device supports TLS 1.2 (check for a firmware update first, as most devices made in the last eight years do) and whether it offers a Microsoft 365 or OAuth sign-in option. Many current Canon, HP, Konica Minolta, Ricoh, Sharp and Xerox models do.
- Find your office's public IP address and whether it's static (ask your broadband provider). Two of the methods depend on it.
Which method should I use?
| SMTP AUTH (client submission) | Direct send | SMTP relay (connector) | |
|---|---|---|---|
| Server | smtp.office365.com | Your MX host, e.g. yourbusiness-co-uk.mail.protection.outlook.com | Your MX host |
| Port | 587 (STARTTLS) | 25 | 25 |
| Encryption | TLS 1.2 or 1.3 required | Optional | TLS recommended |
| Sign-in | Username and password (basic auth) or OAuth of a licensed mailbox | None | None; your static IP or certificate is trusted |
| Can email people outside your business? | Yes | No, only your own Microsoft 365 mailboxes | Yes |
| Needs a licensed mailbox? | Yes | No | No |
| Affected by security defaults? | Yes, blocked when using a password | No | No |
| Limits | 30 messages a minute, 10,000 recipients a day | Normal inbound filtering | Reasonable use |
| Best for | Devices that support OAuth, or where you accept the trade-offs below | Scan-to-email to your own staff only | Offices with a static IP that need to send to customers |
Understand security defaults and SMTP AUTH first
SMTP AUTH is the traditional way to send: the printer signs in to smtp.office365.com with a mailbox's email address and password. That password-based sign-in is called basic authentication, and Microsoft is phasing it out:
- Security defaults (Microsoft's free baseline protection, switched on for most newer tenants) block basic authentication completely, so a printer using a password can't send while they're on. See Set up multi-factor authentication (security defaults).
- SMTP AUTH is switched off by default for each mailbox in tenants created since 2020, so even with security defaults off, you have to turn on Authenticated SMTP for the mailbox the device uses.
- Retirement timeline: Microsoft's latest plan (updated January 2026) is that SMTP AUTH with basic authentication carries on working as now through 2026. At the end of December 2026 it will be switched off by default for existing tenants, though admins can still turn it back on, and new tenants won't have it at all. Microsoft will announce a final removal date in the second half of 2027. Devices that use OAuth aren't affected.
Option 1: SMTP AUTH (smtp.office365.com, port 587)
- Choose the sending mailbox. Use a dedicated licensed user such as
scanner@yourbusiness.co.ukwith a long, unique password, rather than a member of staff's own mailbox (their password changes would break the scanner). See Add a user and assign a licence. - Turn on Authenticated SMTP for that mailbox. In admin.microsoft.com go to Users → Active users → select the user → Mail tab → Manage email apps, tick Authenticated SMTP and select Save changes.
- Check the organisation-wide setting. In the Exchange admin centre, Settings → Mail flow, the option Turn off SMTP AUTH protocol for your organization can stay ticked: the per-mailbox setting from step 2 overrides it.
- If the device uses a password (not OAuth): it will only work while security defaults are off and basic authentication for SMTP is allowed. Read the warning above before going further.
- Enter the settings on the device (see the table below) and send a test scan to an outside address as well as an internal one.
| Device setting | Value |
|---|---|
| SMTP server | smtp.office365.com (never an IP address) |
| Port | 587 |
| Encryption | STARTTLS / TLS (not SSL, and not port 465) |
| Authentication | On: the full email address and password of the sending mailbox, or Microsoft 365 / OAuth if offered |
| From address | The same mailbox address. To send from a different address, the sign-in mailbox needs Send As permission for it (see mailbox permissions) |
Option 2: Direct send (internal recipients only)
The device delivers straight to your Microsoft 365 mail servers, exactly as any outside mail server would. No account, password or licence is needed, but it can only deliver to mailboxes in your own Microsoft 365 organisation.
- Find your MX host. In admin.microsoft.com go to Settings → Domains → your domain → DNS records, and copy the MX value. It looks like
yourbusiness-co-uk.mail.protection.outlook.com. - Configure the device: server = your MX host, port
25, no authentication, TLS on if the device supports it, and a From address on your domain (such asscanner@yourbusiness.co.uk, which doesn't need to be a real mailbox). - Add your office IP to SPF. If your office has a static IP, add it to your domain's SPF record so scans aren't treated as spoofed, for example
v=spf1 ip4:203.0.113.10 include:spf.protection.outlook.com -all. Keep a single SPF record. See Microsoft 365 DNS records on Host Dada nameservers. - Send a test scan and check it doesn't land in Junk.
Set-OrganizationConfig -RejectDirectSend $true, and is working towards disabling direct send by default. If it's turned on in your tenant, devices get the error 550 5.7.68 TenantInboundAttribution; Direct Send not allowed. In that case use SMTP relay with a connector instead.Many UK broadband providers block outgoing port 25 on residential and some business lines. If the device can't connect at all, test from another network or ask your provider.
Option 3: SMTP relay with a connector (static IP)
- Confirm your static public IP. Dynamic IPs aren't supported, and the IP must not be shared with other organisations.
- Create the connector. In the Exchange admin centre (admin.exchange.microsoft.com) go to Mail flow → Connectors → Add a connector. Set Connection from to Your organization's email server (Office 365 is selected as the destination) and select Next.
- Name it (for example "Office scanners"), leave Turn it on ticked and Retain internal Exchange email headers unticked, then Next.
- Choose how to recognise the device: select the option to verify that the IP address of the sending server matches one of your addresses, and enter your office's static IP. (If the device can present a certificate for your domain, the certificate option is more robust.) Select Next, review and Create connector.
- Configure the device: server = your MX host (as in option 2), port
25, TLS on, no authentication, and any From address on your domain. - Add the IP to SPF as in option 2, then test to an outside address.
Troubleshooting
"535 5.7.139 Authentication unsuccessful"
Microsoft 365 rejected the password sign-in. The message usually says why: SmtpClientAuthentication is disabled (turn on Authenticated SMTP for the mailbox), basic authentication is disabled or security defaults policy (basic auth is blocked; switch the device to OAuth or use direct send or a connector), or the password is simply wrong or has expired.
"530 5.7.57 Client not authenticated to send mail"
Authentication isn't switched on in the device's settings, or it's trying to send before starting TLS. Turn on SMTP authentication and STARTTLS on port 587.
"5.7.60 Client doesn't have permissions to send as this sender"
The From address doesn't match the mailbox the device signs in with. Change the From address, or give that mailbox Send As permission over the address you want to use.
The device can't connect, or suggests port 465
Port 465 isn't supported by Microsoft 365. Use port 587 with STARTTLS. If the device only offers SSL on 465, or has no TLS 1.2 support, update its firmware. If no update exists, use direct send or a connector on port 25, or an on-site relay.
Scans arrive in Junk or are quarantined
Typical with direct send or a connector when SPF doesn't include your office IP. Fix the SPF record, check DKIM and DMARC (see Turn on DKIM and DMARC), then release any quarantined messages.
Last reviewed: October 2026
