Home › Guides › Scan to email stopped working with Microsoft 365: what the errors mean and how to fix it

Troubleshooting

Scan to email stopped working with Microsoft 365: what the errors mean and how to fix it

If your printer's scan-to-email worked for years and then stopped, the printer has not broken. Microsoft 365 has stopped accepting the way it sends. This page lists the errors you will find in the printer's log or the bounce message, what each one means, and the fix.

Find the error first

Most printers show the last SMTP error in their web interface (look under email, SMTP, job log or communication log) or on a printed send result report. UPSs, NAS units and server cards usually show it next to the "send test email" button. Match it against the table.

The errors and what they mean

Error	Meaning	Fix
`535 5.7.139 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Tenant`	The device is using SMTP AUTH with a username and password (basic authentication). Microsoft has retired basic authentication for SMTP submission, so the tenant refuses it.	The device cannot do modern authentication. Point it at a relay on your network that can: see what Microsoft changed.
`535 5.7.139 Authentication unsuccessful, the user credentials were incorrect` or `5.7.3 Authentication unsuccessful`	Password changed, MFA enforced, or the mailbox was disabled. Even with the right password, basic auth is no longer accepted.	Same as above. Do not put a mailbox password in a printer again.
`550 5.7.57 Client not authenticated to send anonymous mail during MAIL FROM`	The device is talking to `smtp.office365.com` without authenticating, which that endpoint does not allow.	Use a relay. Do not switch the device to Direct Send: that is being locked down too.
`550 5.7.68 TenantInboundAttribution; Direct Send not allowed for this organization from unauthorized sources`	The device was using Direct Send (sending to your tenant's MX record with no authentication) and the tenant now rejects it.	Use a relay on your network. Turning Direct Send back on is a security regression and Microsoft is steering tenants away from it.
`550 5.7.64 TenantAttribution; Relay Access Denied`	The device is sending to a recipient outside your tenant via Direct Send, which never allowed external recipients.	Use a relay that can send to any recipient as your scanner mailbox.
`554 5.2.252 SendAsDenied` or `5.7.60 Client does not have permissions to send as this sender`	The account is authenticating but is not allowed to send as the From address the printer uses.	Either grant Send As or, better, use a relay that always sends as one designated scanner mailbox.
TLS or certificate errors: `SSL handshake failed`, `STARTTLS required`, `certificate verify failed`	Microsoft requires TLS 1.2 or later; older printers only speak TLS 1.0/1.1 or have a stale certificate store.	A firmware update sometimes helps; a relay on the LAN removes the need for the printer to do TLS at all.
`4.4.1 Connection timed out` or `Cannot connect to SMTP server` on port 25	Your ISP or firewall blocks outbound port 25.	Point the device at a relay on the LAN; the relay talks to Microsoft over HTTPS, which is never blocked.
Message accepted, arrives in Junk or is quarantined	Sending through a third-party SMTP service or from an address that fails SPF/DMARC.	Send from inside the tenant, as a real mailbox, so SPF and DKIM pass automatically.

Why the usual fixes do not last

Entering the password again does nothing: the tenant refuses basic authentication regardless of the password.
Enabling SMTP AUTH on the mailbox in Exchange admin used to work. It no longer does, because the authentication method itself is retired.
Direct Send (printer → your MX record, no login) works until the tenant's Reject Direct Send setting is turned on, which security guidance now recommends, and it never worked for external recipients.
An SMTP relay connector needs a static public IP, sends unauthenticated mail out of your office, and breaks if the IP changes.
Cloud SMTP services take your scans out of the tenant through a third party, cost a monthly fee, and change your SPF record.

The fix that lasts

Put a small relay on your own network that speaks plain SMTP to the devices and modern authentication to Microsoft. The device settings go back to what they were ten years ago: a server address, a port, no login, no TLS. The relay holds one properly secured application identity for your tenant and does the modern part. SMTP-365 is that relay, packaged as an appliance you set up from a browser in about twenty minutes, and one of them covers every device on the site.

Printer-specific settings

Canon · Ricoh · Konica Minolta · Xerox · HP · Kyocera · Brother

Fix it once, for every device. SMTP-365 is a small appliance on your network that accepts plain SMTP from printers, UPSs, servers, NAS and phone systems and delivers it into your own Microsoft 365 tenant with modern authentication. One licence covers every device on the site. Download the free 30-day trial See pricing

Updated 2026-10-10. Menu names and screens vary between models and firmware versions; if yours differs, look for the same fields under the device's email, SMTP or notification settings. Corrections welcome at helpdesk@smtp-365.com.