If the office multifunction printer no longer sends scans by e-mail, or an old program or website can no longer send notifications, the likely cause is a change in Microsoft 365. In 2026 Exchange Online switched off Basic authentication for SMTP AUTH client submission. Devices that send mail with just a username and password need to be reconfigured.
Symptoms
- Scan to e-mail fails and the device shows "Authentication failed", "SMTP error" or "Send failed".
- The device log or the app's error message shows
535 5.7.139(Authentication unsuccessful) or another error starting with 535. - Nothing in the setup has changed and the password is correct, but sending stopped one day.
- The same problem affects an old accounting or stock program, a website contact form or server alerts that use the server
smtp.office365.comon port 587.
The cause
The device used to sign in to Microsoft 365 with a username and password, just like a person. That method does not support multi-factor authentication and was an easy target for attackers, so Microsoft turned it off. You now need either modern authentication (OAuth) or a different way of sending.
Five options
- The device supports OAuth (Modern Authentication). After a firmware update, many newer devices offer a "Microsoft 365" or "OAuth 2.0" option. Update the firmware, set up the account again and confirm the sign-in on the Microsoft page. Check the manufacturer's documentation to see whether your model supports it.
- Direct send to internal recipients. The device sends mail straight to your domain's MX endpoint (for example
yourdomain-ee.mail.protection.outlook.com) on port 25, with no sign-in. It works only for mailboxes in your own organisation. Add the office's public IP address to your domain's SPF record, otherwise messages may land in junk. Some internet providers block outbound port 25, and if an administrator has disabled direct send for the organisation, this option will not work. - SMTP relay with a Microsoft 365 connector. In the Exchange admin center you create a connector (Mail flow → Connectors) that recognises the device by the office's static public IP address. The device also sends to the MX endpoint on port 25. This lets you send to external recipients too. You need a static IP, and the sender address must be in your domain.
- Scan to a folder instead of e-mail. Scans are saved to a network share (SMB) or, through the manufacturer's cloud connector, to SharePoint or OneDrive. This is often more convenient: files land in the right place straight away and mailboxes do not fill up.
- Third-party SMTP service. A dedicated mail-sending service with its own username and key. Especially suitable for websites and applications. Set up SPF and DKIM for your domain so the mail is delivered.
Comparison
| Option | Pros | Cons |
|---|---|---|
| OAuth | Secure, sends anywhere, setup stays similar | Old devices do not support it, needs a firmware update |
| Direct send | Simple, no password or licence needed | Internal recipients only, port 25 may be blocked |
| Relay with a connector | Sends externally too, no password | Needs a static IP and Exchange configuration |
| Scan to folder | Independent of e-mail, files land in the right place | Needs share and permission setup; SMB issues on old devices |
| Third-party SMTP | Suits applications and websites | An extra service and cost, needs DNS setup |
When to call a professional
If the device does not support OAuth, or several devices and programs send mail, it is worth choosing one approach for the whole office and setting it up properly, including SPF. ITABIKS can do this as part of Microsoft 365 administration, phone +372 53 888 229.