Scan to email and the December 2026 Microsoft 365 change: what to check now

If your printer or photocopier sends scans out by email, there is a change coming at the end of December 2026 that could stop it working. It is not a fault with your machine and there will be nothing to repair — it is a security change on Microsoft’s side, and the machines most likely to be caught out are the ones that have been quietly scanning to email for years without anyone touching the settings.

What is actually changing

Microsoft is retiring Basic Authentication for SMTP AUTH client submission in Exchange Online. Basic Authentication is the old method where a device signs in with just a username and password. It is being replaced by modern authentication, known as OAuth, which does not rely on a stored password in the same way.

Microsoft published an updated timeline in January 2026. The milestones that matter are:

• Now until December 2026: nothing changes. Existing setups carry on working.
• End of December 2026: SMTP AUTH Basic Authentication is disabled by default for existing tenants. Administrators can still switch it back on if they need to.
• New tenants created after December 2026: Basic Authentication is not available at all. OAuth is the supported method.
• Second half of 2027: Microsoft will announce the final removal date, after which re-enabling will no longer be an option.

The important word in that second point is default. This is not the end of the road in December, but it is the point at which a lot of scanners will stop sending without warning, because the setting will be turned off for them rather than by them.

Does this affect you?

It affects you if all three of these are true:

• Your email is on Microsoft 365 or Office 365 — not an independent mail provider or your own mail server.
• Your printer or photocopier sends scans by email, rather than only scanning to a folder on your network.
• The machine was set up with a mailbox username and password typed into its settings, which is how the great majority of scan-to-email configurations have historically been done.

If you scan only to a shared folder, this particular change does not affect you. If you are on Google Workspace or another provider, this specific announcement does not apply either, although the general direction of travel across the industry is the same.

What the alternatives are

Microsoft documents several ways for a device like a scanner to send email, and the right one depends on your machine’s age and where your scans need to go.

1. Authenticated submission using OAuth

This is the direct replacement and the preferred route. The machine still signs in to a licensed mailbox, but using modern authentication instead of a stored password. The catch is that the printer’s firmware has to support it. Newer models from the main manufacturers increasingly do; older machines often do not, and no amount of configuration will add it. The device also needs to support TLS 1.2 or later to use this method at all.

2. SMTP relay through an inbound connector

Here the machine sends through a connector configured in Microsoft 365, authenticated by a certificate or by a static public IP address that is not shared with another organisation. This is the usual answer for older equipment that cannot do OAuth but still needs to send scans to people outside your organisation. It requires port 25 to be open and a static IP from your internet provider, so it is worth checking what your broadband contract actually gives you.

3. Direct send

The machine sends straight to Microsoft’s servers without authenticating. It is simpler to configure, but it has a significant limitation: it cannot deliver to external recipients. If everyone who receives your scans has an address at your own domain, this can be perfectly workable. If you scan documents out to clients, accountants or suppliers, it is not. It also relies on your SPF, DKIM and DMARC records being set up correctly, or your scans will land in junk folders.

4. A third-party relay or an on-premises mail server

Some businesses route device email through a separate relay service or through an existing on-premises server. This can be the pragmatic option where there is a mixed estate of older machines.

What we would suggest doing now

There is no need to rush, but there is every reason not to leave this until the week before Christmas, when support availability everywhere is at its thinnest.

• Make a list of every machine in the business that sends email, including any older device tucked away in a back office.
• Ask your IT provider or whoever administers your Microsoft 365 tenant whether SMTP AUTH is currently in use, and for which mailboxes.
• Check whether each machine’s firmware supports OAuth. On many models this is a firmware update rather than a replacement, and it is worth finding out which category yours falls into well before the deadline.
• Decide where your scans genuinely need to go. If they only ever go to colleagues, your options widen considerably.
• Test the replacement method before December rather than after, so that you find any problem while the old method is still working as a fallback.

It is also worth using this as a prompt to check who the scanner’s mailbox actually belongs to. A device signed in as a member of staff who has since left is a problem waiting to happen regardless of what Microsoft does.

Where we can help

We service Konica Minolta, Ricoh and Xerox machines for businesses across England, so if you are unsure whether your model can handle modern authentication, or whether a firmware update will get you there, we can tell you. For companies with several machines, this is exactly the sort of thing we keep track of under managed print services, so it does not become a surprise.

You speak directly to the engineer here rather than a call centre. Call 07730 330415 or get in touch and we will talk it through.