Printing guide
Scan-to-Email Stopped Working With Microsoft 365: Choosing the Right Configuration
Scan-to-email is one of the most common casualties of changes in Microsoft 365 security. The copier is usually configured correctly for the way things used to work. The fix is to choose the sending method that suits the device and the recipients, and configure it deliberately.
The three supported methods
| Method | Endpoint | Port | Authentication | Can send externally |
|---|---|---|---|---|
| SMTP client submission | smtp.office365.com | 587 | Licensed mailbox sign-in | Yes |
| SMTP relay (connector) | Your MX endpoint | 25 | Static public IP or certificate | Yes |
| Direct Send | Your MX endpoint | 25 | None | No, internal only |
Step-by-step
Find out what changed
Check the error on the device's job log or status page. Authentication failures point to SMTP client submission. A recent firewall or internet change, such as a new public IP address, affects SMTP relay. Messages that never arrive for external recipients are expected with Direct Send.
SMTP client submission
The device signs in to a licensed mailbox. SMTP AUTH must be enabled for that mailbox; it is disabled by default in newer tenants. TLS 1.2 or later is required, and port 465 is not supported. Microsoft has announced the deprecation of Basic authentication for this method, and many older devices can't use modern authentication, so check the device's capabilities before relying on it. Security defaults also block Basic authentication.
SMTP relay through a connector
Create an inbound connector in the Exchange admin center that accepts mail from your office's static public IP address, or from a certificate on the device. Point the device at your MX endpoint on port 25 with TLS. No mailbox or licence is needed, and the device can send to external recipients as long as the sender address uses one of your accepted domains. This is usually the most robust option for an office with a fixed IP.
Direct Send
The device sends directly to your MX endpoint without authentication, but can only deliver to recipients inside your organization. It is suitable when scans only ever go to staff, but Microsoft recommends it only where other methods aren't possible. Your SPF record must include the office's public IP.
Test and document
Microsoft provides a diagnostic for this configuration at
aka.ms/smtprelay, which requires an admin account. Once working, record the method, IP addresses and any service mailbox used, so the next internet or firewall change doesn't break it again.
Alternatives worth considering
Many current devices can scan directly to a network folder, SharePoint or OneDrive. Where the main purpose is filing documents rather than emailing them, scan-to-folder or scan-to-cloud avoids email authentication entirely.