Scanner Stopped Emailing? Fixing Scan-to-Email on Microsoft 365
Most scanners send email through Microsoft 365 by signing in with a mailbox’s username and password, and Microsoft is switching that off at the end of December 2026. When it stops, the scanner usually just says “send failed” or “connection error”. The fix is to give it another way to send, and which one depends on your scanner and who the scans go to.
Email Fix is an independent service and is not connected with Microsoft or any scanner manufacturer.
Why it stops
Scan-to-email is usually set up once, often by the copier supplier, and then forgotten. The scanner was given:
- the server
smtp.office365.com, port587 - the email address and password of a mailbox, often a real person’s
That way of signing in is called Basic authentication for SMTP AUTH. At the time of writing (last checked 9 October 2026), Microsoft switches it off by default on existing accounts at the end of December 2026, and will announce a date to remove it for good in the second half of 2027. My guide to what stops working when Microsoft 365 switches off basic SMTP sign-in has the timeline.
It can also stop sooner, for other reasons:
- The mailbox’s password was changed, or the person left and their mailbox was removed.
- Two-step sign-in (MFA) was turned on for that mailbox.
- An administrator has already switched off SMTP AUTH for the mailbox or the whole account.
If the scanner shows or logs an error, 550 5.7.30 means the sign-in method was refused, and 535 5.7.139 or 535 5.7.3 means the sign-in itself was refused: a wrong password, two-step sign-in, or SMTP AUTH switched off for that mailbox. My page on 550 5.7.30 covers the first.
First, two questions
- Who do the scans go to? Only people in your own organisation, or also clients and suppliers outside it?
- Does your office have a fixed (static) internet address? Your broadband provider can tell you. Many business broadband packages include one.
The four ways to fix it
Swipe sideways to see the whole table.
| Option | Suits | What it needs |
|---|---|---|
| 1. Modern sign-in on the scanner | Newer scanners | A firmware update or setting that supports “Microsoft 365” or “OAuth” |
| 2. Direct send | Scans that only go to your own staff | The scanner pointed at your domain’s Microsoft 365 mail address, port 25, no sign-in |
| 3. A connector (SMTP relay) | Scans to anyone, from one office | A fixed internet address, and an administrator to set up the connector |
| 4. Scan to a folder instead | Anyone | OneDrive, SharePoint or a network folder, if the scanner supports it |
1. Modern sign-in on the scanner
Many scanners sold in the last few years can sign in to Microsoft 365 properly. Look in the scanner’s web settings page for “OAuth”, “Modern authentication” or “Microsoft 365”, or ask the supplier whether a firmware update adds it. Where it exists, this is the simplest fix: nothing else changes.
2. Direct send
The scanner sends straight to your domain’s Microsoft 365 mail address (it looks like yourcompany-co-uk.mail.protection.outlook.com, and is your domain’s MX record) on port 25, with no username or password. It can only deliver to mailboxes in your own organisation.
- Add your office’s internet address to your SPF record, or the scans may be marked as spam.
- Microsoft lets administrators block direct send altogether (“Reject direct send”). If it is switched on, this option won’t work, and switching it off weakens your protection against forged email. Ask your administrator.
3. A connector (SMTP relay)
Your administrator creates a connector in the Exchange admin centre that trusts your office’s fixed internet address. The scanner sends to the same address as direct send, on port 25, with no password, and can then send to anyone.
- Needs a fixed internet address. If the office’s address changes, the scans stop.
- Add the office’s internet address to your SPF record.
- Port
25must not be blocked by your broadband provider; some block it on home and basic business lines.
4. Scan to a folder instead of email
Many scanners can save straight to OneDrive, SharePoint, Google Drive or a shared folder on the office network. If scans were only being emailed to yourself so you could save them, this avoids email altogether.
What not to do
- Don’t switch basic sign-in back on and forget about it. It is a stopgap until Microsoft’s final date, which hasn’t been announced yet.
- Don’t take two-step sign-in off a real person’s mailbox so the scanner keeps working. That mailbox is worth more to a criminal than the scanner is to you.
- Don’t give the scanner a free Gmail or Outlook.com account to send from your business. Scans from a free address are more likely to land in spam, and the password still has to sit in the scanner.
Test it
Scan one page to yourself and to a personal Gmail address (if scans go outside your organisation). Both should arrive within a minute. In Gmail, under the three dots and “Show original”, SPF should show PASS. If it shows FAIL or SOFTFAIL, your SPF record is missing the office’s internet address; my guide to SPF, DKIM and DMARC explains why that matters.
Where to go from here
- Microsoft 365 is switching off basic SMTP sign-in, for everything else in the office that may stop.
- 550 5.7.30: Basic Authentication Not Supported, if you have that error.
- What is SPF, DKIM and DMARC?, for the records a new sending route needs.
Need help fixing this?
I provide:
- Free initial assessment
- Clear explanation of the issue
- Fixed-price solutions
- UK-based support
Tell me your scanner’s make and model and where the scans go, and I’ll pick the right option and set it up with you.