Scan-to-email keeps working after Microsoft switches off Basic SMTP
At the end of December 2026, Microsoft disables Basic authentication for SMTP AUTH by default in existing Exchange Online tenants. Copiers, scanners, line-of-business apps and scripts that send mail with a username and password will start failing with error 550 5.7.30. SMTP Switch finds every one of them in your tenant, chooses the right replacement for each device, makes the change and tests it, as a one-time job.
- A free exposure check from Microsoft's own SMTP AUTH report: every device, app and mailbox still on Basic auth, with send volumes, before you pay anything.
- One fix per sender, chosen on the facts: OAuth where the firmware supports it, a connector relay, High Volume Email for internal-only mail, or an SMTP service.
- Tested before and after with a scan or message from each device, and a sign-off report you can hand to management or your client.
Microsoft's January 2026 update: Basic auth for SMTP AUTH is unchanged until December 2026, disabled by default for existing tenants at the end of December 2026, with final removal to be announced in the second half of 2027.
Source: itelio.comClients still using Basic auth are rejected with the error 550 5.7.30, Basic authentication is not supported for Client Submission.
Source: captaindns.comHigh Volume Email for Microsoft 365 is billed at $42 per million recipients from June 2026 and only delivers to recipients inside the tenant.
Source: office365itpros.comEvery scanner that emails a PDF is about to need a different way to send
Most multifunction printers, and plenty of accounting systems, alarm panels and old scripts, send email through smtp.office365.com with a mailbox username and password. That is Basic authentication for SMTP AUTH, and Microsoft is retiring it. After several postponements, the current timeline is that Basic auth stays as it is until December 2026, is disabled by default for existing tenants at the end of that month, and is removed for good on a date Microsoft will announce in the second half of 2027.
When it stops, nothing warns the person at the copier. The scan simply never arrives, or an app logs 550 5.7.30 and gives up. Invoices are not sent, scanned delivery notes go missing, and the office finds out a week later.
The fix is not one setting. Some devices can be updated to OAuth; many older ones never will be. Some only send to colleagues, which suits Microsoft's paid High Volume Email; others send to customers, which HVE cannot do. Some sit behind a fixed IP and can use a connector relay. SMTP Switch works through the list device by device so each one ends up on the cheapest option that will keep working.
Without it
- Doing it yourself: Free if you have the time and the admin skills: Microsoft documents the report, connectors, OAuth and HVE. The work is…
- Waiting for the copier vendor: Some vendors are adding OAuth in new firmware, and many models never will get it. Worth checking first; risky to rely…
- Re-enabling Basic auth after the cutoff: Admins of existing tenants can switch Basic auth back on after December 2026, which buys time until the final removal…
With SMTP Switch
- A free exposure check from Microsoft's own SMTP AUTH report: every device, app and mailbox still on Basic auth, with send volumes, before you pay anything.
- One fix per sender, chosen on the facts: OAuth where the firmware supports it, a connector relay, High Volume Email for internal-only mail, or an SMTP service.
- Tested before and after with a scan or message from each device, and a sign-off report you can hand to management or your client.
- Complete sender inventory
- Device-by-device recommendation
How it works
- 1
Free exposure check
You grant a temporary read-only admin consent, or run one script we send. We pull the SMTP AUTH Clients Submission report and sign-in data and list every sender still on Basic auth, with volumes and recipients.
- 2
A plan per sender
For each device or app we check the model and firmware, whether it mails people outside the company, and your network setup, then recommend OAuth, a connector relay, High Volume Email or an SMTP service. You approve the plan.
- 3
We make the switch
We set up the connector, HVE account or service and change each device's settings remotely where its web panel is reachable, or send your on-site person a one-page sheet per device with the exact values.
- 4
Test and sign off
A scan or test message from every device, confirmed in message trace, then Basic auth turned off for the tenant ahead of Microsoft's date so nothing surprises you in January. You get the report and the configuration record.
Features
Complete sender inventory
Every mailbox, device and application that authenticated with Basic SMTP AUTH in the reporting window, with message counts, so nothing is found by accident in January.
Device-by-device recommendation
Firmware and model checked against the vendor's OAuth support. Where a firmware update adds OAuth, we say which version and whether it is safe to apply.
Connector relay setup
An Exchange Online inbound connector restricted to your office's fixed IP or certificate, for devices that cannot do OAuth and need to mail external recipients.
High Volume Email setup
HVE accounts for devices that only send to colleagues, such as scan-to-self, with the pay-as-you-go billing explained before it is switched on.
Per-device instruction sheets
One page per device with the server, port, encryption and account values, written for the person standing at the copier, in English or in the language your office uses.
Cutover and rollback plan
Basic auth disabled for the tenant only after every sender is tested, with a documented way back for any device that misbehaves.
Sign-off report
What was found, what was changed, how each sender now authenticates and what to do when a new device is installed. MSPs get it under their own brand.
A look inside
What you get: the working view and the delivery report.
Who it's for
Small and mid-size businesses on Microsoft 365
A few copiers and an accounting system that email PDFs, and no one in-house who wants to learn connectors and OAuth before Christmas.
Schools, clinics and municipalities
Many sites, many scanners of different ages, and a hard requirement that scanned documents keep arriving.
Managed service providers
Dozens of client tenants with the same problem. Hand us the inventory and the device changes, keep the client relationship and the report under your brand.
Works with
- Exchange Online and Microsoft 365 admin center
- SMTP AUTH Clients Submission report and message trace
- Exchange Online inbound connectors (IP or certificate)
- High Volume Email for Microsoft 365
- OAuth 2.0 SMTP on supported devices
- Canon, HP, Konica Minolta, Kyocera, Ricoh, Sharp, Xerox and Brother web panels
- Third-party SMTP services for external mail
- Microsoft Graph sendMail for scripts and apps
Pricing
The exposure check is free: we tell you how many senders will break and what each needs before you decide. Fixes are one-time prices per Microsoft 365 tenant, paid once. No subscription. Third-party costs, such as High Volume Email usage or an SMTP service, are billed to you directly by those providers at their published rates. Founding customer pricing applies to early-access orders.
Small office
$99 one-time
One site with a copier or two
- Up to 3 Basic-auth senders
- Free exposure check first
- Per-sender plan and remote configuration
- Per-device instruction sheets
- Test and sign-off report
Business
$249 one-time
Several sites, mixed device ages, a few line-of-business apps
- Up to 15 Basic-auth senders
- Everything in Small office
- Connector relay or HVE setup
- Script and app changes to OAuth or Graph
- Tenant cutover with rollback plan
- 30 days of follow-up for missed devices
MSP pack
$590 one-time
IT providers migrating several client tenants
- 5 tenants, up to 15 senders each
- Everything in Business
- Reports under your brand
- Shared runbook your team can reuse
- Priority scheduling before the December cutoff
- Extra tenants at $99 each
Compared with the alternatives
- Doing it yourself
- Free if you have the time and the admin skills: Microsoft documents the report, connectors, OAuth and HVE. The work is in matching each device to the right option and visiting each one, which is where most small offices stall.
- Waiting for the copier vendor
- Some vendors are adding OAuth in new firmware, and many models never will get it. Worth checking first; risky to rely on for every device in the building.
- Re-enabling Basic auth after the cutoff
- Admins of existing tenants can switch Basic auth back on after December 2026, which buys time until the final removal date Microsoft will announce in 2027. It postpones the work rather than doing it.
- Hosted relay subscriptions
- SMTP relay services charge monthly and work well for external mail. SMTP Switch is a one-time job that often ends with no new subscription at all, and uses a relay service only where it is the right answer.
What changed
- Microsoft's January 2026 update: Basic auth for SMTP AUTH is unchanged until December 2026, disabled by default for existing tenants at the end of December 2026, with final removal to be announced in the second half of 2027. Source: itelio.com
- Clients still using Basic auth are rejected with the error 550 5.7.30, Basic authentication is not supported for Client Submission. Source: captaindns.com
- High Volume Email for Microsoft 365 is billed at $42 per million recipients from June 2026 and only delivers to recipients inside the tenant. Source: office365itpros.com
From request to switched off, safely
We start the inventory within 2 business days of your request; most small offices are finished within a week.
- Day 1: Request the service; we send the read-only consent link or inventory script.
- Day 2–3: Free exposure check and per-sender plan delivered; you decide and confirm the price.
- Day 4–6: Connectors, HVE or OAuth set up; devices reconfigured remotely or with your on-site person.
- Day 7: Every sender tested, Basic auth disabled for the tenant, sign-off report delivered.
Security and data
- Inventory access is read-only and time-limited; you can revoke the consent at any time and we confirm when we have finished.
- Configuration changes use an account you create for the job and delete afterwards; we never ask for a Global Administrator password by email.
- Device passwords and connector details are stored only in your sign-off report and our encrypted job record, which is deleted 30 days after the job.
- Every change is logged with the time and the person who made it, and included in the report.
Questions
When exactly will scan-to-email stop working?
Under Microsoft's current timeline, Basic auth for SMTP AUTH is disabled by default for existing tenants at the end of December 2026. Admins can re-enable it for a while, and Microsoft will announce the final removal date in the second half of 2027. Check Message Center post MC786329 in your tenant for the latest dates.
How do I know if we are affected?
If any device or app sends through smtp.office365.com on port 587 with a mailbox username and password, it is affected. The SMTP AUTH Clients Submission report in the Exchange admin center shows which senders still use Basic auth; our inventory starts there.
Do you need full admin access to our tenant?
No. The inventory needs read-only reporting access, granted temporarily and revocable. For the changes we either work with a time-limited admin account you create and remove afterwards, or guide your admin through each step.
Can High Volume Email send scans to customers?
No. High Volume Email only delivers to recipients inside your own tenant. Devices that email customers or suppliers need OAuth, a connector relay or an SMTP service instead, and the plan says which per device.
What if a copier can't be reached remotely?
We send a one-page sheet for that device with the exact settings, and stay on a call with whoever is on site while they enter them. Most changes take a few minutes per device.
Is there any ongoing cost after the job?
Often none. A connector relay costs nothing extra. High Volume Email is pay-as-you-go at Microsoft's published rate, and an SMTP service, if needed, is billed by that provider. We never resell those services with a markup.
Is this an official Microsoft service?
No. SMTP Switch is an independent IT service. We use Microsoft's documented features and your tenant stays under your control throughout.
Ready when you are
Tell us about your setup. We confirm by email and get you running within 2 business days.
Request service