Scan-to-Email May Stop Working in December 2026: What to Check

The “Scan to email” button on the office multifunction printer has worked for years, so nobody touches it. One morning it throws an error, accounting goes back to scanning invoices by hand, and word gets around that the printer is broken. It is not broken. Your Microsoft 365 tenant has most likely stopped accepting the old sign-in method the printer uses.

That method is SMTP AUTH with Basic authentication. The device sends a username and password straight to Exchange Online, with no second check in between. Microsoft is switching it off, and the schedule changed recently.

Where the timeline stands

Microsoft first planned a gradual shutdown for March and April 2026. An update on 27 January 2026 put that plan on hold. The current schedule:

• Until December 2026, behaviour is unchanged. Your printer keeps working.
• At the end of December 2026, Basic authentication is disabled by default for existing tenants. An admin can turn it back on.
• Tenants created after December 2026 get it disabled from day one and must use OAuth.
• Microsoft will announce the final removal date in the second half of 2027.

So there is no cliff in January, but you can end up with a printer that stays dead until someone re-enables the setting. By late 2027 that option disappears too.

One boundary matters here. The change affects authenticated client submission only. If your printer sends through a connector tied to your public IP address, with no credentials, this does not apply to it.

Find out who is sending through that door

Printers are the obvious case, not the only one. The usual suspects:

• Multifunction printers and scanners
• NAS boxes, UPS units and camera systems that email alerts
• Older ERP, CRM and accounting software sending invoices or notifications
• A script someone wrote years ago that still runs from Task Scheduler
• The contact form on your website, if your host sends mail with your account

Do not guess, measure. The Exchange admin center has an “SMTP AUTH Clients Submission” report that shows whether each client uses Basic or OAuth. Put every account it lists into one inventory table: account, which device or program, who owns it, whether recipients are internal or external.

Which replacement fits which device

Method	Recipients	What you need	Note
SMTP AUTH with OAuth (port 587)	Internal and external	Device must support OAuth, app registration	The right answer. Many older printers cannot
SMTP relay (port 25), IP-based connector	Internal and external	Static public IP, connector in Exchange	No password stored on the device. Breaks if the IP changes
Direct send (to your own MX, port 25)	Your own domain only	No credentials	Enough for “scan to myself”
Scan to a shared folder	No email	A folder on a server or NAS	Not using email at all is also a fix

For most offices the honest answer is this: direct send if the printer only scans to staff, a connector with a static IP if mail must leave the company, and OAuth only if the model you just bought supports it. The first thing we ask is the device model. If the manufacturer does not list Microsoft 365 OAuth support and has no firmware update promised, we move to a connector instead of fighting the device.

A third-party SMTP service is also possible, though every message then passes through a provider outside your company, which you should think about for scanned documents. Microsoft’s new High Volume Email service can only send to recipients inside your own tenant, and at the time of writing it is in preview.

The order to work in

1. Run the report and list every account still using Basic.
2. Find an owner for each. Close accounts with no owner and no sending in the last three months.
3. Pick a replacement per device from the table. Do not switch everything at once, start with the least critical device.
4. If you need a static IP, ask your ISP now. Many take several days to provision one.
5. By the first week of December, the Basic list should be empty. If it is not, write down which account is left and why.

There is a hidden cost in all this. Accounts that hold a password on a device often end up exempt from multi-factor authentication. Removing those exemptions is a welcome side effect. If an account’s only job is sending mail, give it no other permissions.

Frequently asked questions

Does it stop the day Basic authentication is disabled? For existing tenants the default setting turns off, though an admin can re-enable it. If nobody does, sending stops. The setting can probably stay on until the final date in the second half of 2027, but Microsoft has not announced that date yet.

Is re-enabling it temporarily reasonable? As a stopgap in an emergency, yes. As a plan, no. On the admin side there is a tenant-level setting (SmtpClientAuthenticationDisabled), and mailbox-level controls too. Write a closing date next to anything you open.

Does this affect our on-premises Exchange server? The announcement covers Exchange Online. On-premises Exchange has its own schedule.

Should we do this ourselves? The inventory and the report are half a day for whoever runs IT. The connector and device settings need your printer vendor and your Exchange admin at the same table, and that is where we usually see projects stall. If you use our managed IT service we can build the inventory for you. Write to us through the contact page.