Home › Guides

Your copier may stop scanning to email in January: the Microsoft 365 change small offices should check before the holidays

By Greg Mitchell · Squared Away Tech · November 4, 2026

Picture the first Monday after New Year’s. Front desk tries to scan a signed form to a patient, a client or a vendor. The copier whirrs, then flashes an authentication error. Nobody changed the Wi-Fi. The internet is fine. What changed is a Microsoft 365 default that a lot of small offices never knew they depended on.

Microsoft is turning off SMTP AUTH Basic Authentication by default for existing tenants at the end of December 2026. In plain English: devices that send email with a saved username and password to smtp.office365.com may stop working unless someone plans ahead. You do not need to be an IT person to run a quick check this month.

What SMTP AUTH basic sign-in is (without the jargon)

Many multifunction printers and scanners do not use Outlook. They talk straight to Microsoft’s mail servers with a setting that looks like this: server smtp.office365.com, port 587, a Microsoft 365 email address, and a password stored on the device. That username-plus-password handshake is SMTP AUTH with basic authentication.

Your everyday Outlook and phone mail apps usually do not work that way anymore. They use modern sign-in. The leftover problem is hardware and little apps set up years ago and never revisited: the copier, a postage meter, an alarm panel that emails alerts, or a fax-to-email bridge.

Microsoft’s timeline (so you know what is coming)

According to the Exchange Team’s updated timeline (posted January 2026, updated January 29, 2026):

• Now through December 2026: SMTP AUTH Basic Authentication behavior stays unchanged.
• End of December 2026: SMTP AUTH Basic Authentication is disabled by default for existing tenants. Admins can still turn it back on if needed.
• New tenants created after December 2026: SMTP AUTH Basic Auth is unavailable by default; OAuth is the supported method.
• Second half of 2027: Microsoft will announce the final removal date for SMTP AUTH Basic Authentication.

January is when many offices first notice. Re-enabling is possible for a while, but it is a bridge, not a forever plan. Microsoft’s docs on authenticated client SMTP submission cover the organization and mailbox toggles.

What actually breaks

Anything that sends outbound mail with a stored Microsoft password is in scope. Common examples:

• Copiers and MFPs with “scan to email”
• Desktop scanners and document feeders
• Some fax appliances, postage devices and alarm or access systems
• Line-of-business apps that email invoices or reports through Office 365 SMTP

If the device was set up with someone’s personal work password, a shared mailbox password, or an old office manager’s login, you have two problems: the January outage risk, and the ownership risk I wrote about in who really owns your Microsoft 365.

Step 1: Inventory every device and app that sends email from the office

Walk the floor with a notepad (or a shared OneNote page). Ask front desk, billing and whoever runs the copier lease:

1. Which machines can email a scan, a receipt or an alert?
2. Where are the SMTP settings? (Often under Network, Email, Scan or Administrator on the device web page.)
3. What username and server are saved? Screenshot them if you can.
4. Which little apps or servers email reports overnight?

You are making a list so January is not a surprise.

Step 2: Check the SMTP AUTH clients report in Exchange admin center

Microsoft keeps a report of clients still using SMTP AUTH. An admin can open Exchange admin center and find the SMTP AUTH clients report. Note which mailboxes show up and when they last authenticated, then match them to your device list. If a mailbox named after a departed employee is still sending from the copier at 7 a.m., that is your smoking gun. Also check whether Security defaults or an authentication policy already blocks basic SMTP; those can override a simple “turn it back on” toggle.

Step 3: Whose password is on the machine?

This is the ownership question again. I see the same pattern around here: the person who set up the copier left, but their password is still typed into the printer. Sometimes it is a Global Admin. Sometimes it is a shared front-desk mailbox nobody rotates.

• If the account belongs to someone who left, treat it like any other leftover admin access: replace it, then remove or block the old account. See who owns your Microsoft 365 and what to do when you’re the only admin.
• Never leave a Global Admin password on a copier sitting in a hallway.
• Prefer a dedicated low-privilege mailbox used only for scanning if you must keep password-based SMTP for a short time.

Step 4: Short-term bridge after December 2026

If scan-to-email must keep working on day one of January and you have not finished a longer fix, an admin can re-enable SMTP AUTH for the tenant and/or specific mailboxes. Microsoft’s guidance is to keep it off organization-wide when you can, and enable Authenticated SMTP only on the mailboxes that still need it (Users → Active users → Mail → Manage email apps).

Step 5: Longer-term options in plain English

There is no single answer for every brand of copier. Ask your vendor what they support today, and do not take “it used to work” as a plan.

1. Manufacturer cloud or modern-auth scan features. Some newer MFPs can send through the vendor’s cloud or with OAuth. Firmware and model matter; older leases often cannot.
2. Exchange Online connector / direct send with a static public IP. If your office has a fixed public IP, Microsoft can accept mail from that IP without storing a user password on the device. Many small Bradenton and Sarasota offices on cable or consumer fiber do not have a static IP, so ask your ISP first. If you go this route, keep SPF accurate so those messages do not look like spam (see what DMARC is, and why email lands in spam).
3. OAuth on the device, if the firmware truly supports it. Do not assume a checkbox labeled “Office 365” means modern auth.
4. Change the workflow. Scan to a OneDrive or SharePoint folder, then share the file. For many offices this is simpler and safer than fighting a ten-year-old SMTP panel.

I will not promise that every copier on a five-year lease has a clean upgrade path. Some do. Some need a different workflow. That honesty saves a week of blaming “the internet.”

What I see in local offices

Around Bradenton, Sarasota and Lakewood Ranch, scan-to-email is how dental and medical front desks move signed forms, how law firms file wet-ink signatures, and how property managers push leases. Those offices often still have leftover settings from a prior IT company (see signs your Microsoft 365 tenant isn’t locked down and the Bradenton dental and medical checklist). Checking the copier before the holidays prevents a loud January. A structured pass across sign-ins, forwarding and mail flow is part of my Microsoft 365 Security Checkup.

FAQ

Will our Outlook and phones stop sending email too?

No. Modern Outlook, Outlook on the web, and most phone mail apps do not use SMTP AUTH with a plain username and password to send mail. This change mainly hits devices and apps that still store a Microsoft password to talk to smtp.office365.com, such as older copiers and scanners.

How do I know if our copier uses SMTP AUTH?

Check the device’s email or SMTP settings for a server like smtp.office365.com, a username that looks like an email address, and a saved password. In Exchange admin center, open the SMTP AUTH clients report to see which mailboxes devices have been using recently.

Can we turn SMTP AUTH basic sign-in back on after December 2026?

Yes, for existing tenants. Microsoft says admins can still re-enable SMTP AUTH Basic Authentication after it is disabled by default at the end of December 2026. Treat that as a temporary bridge while you move devices to a better method. Microsoft plans to announce a final removal date in the second half of 2027.

Should we put a Global Admin password on the copier?

No. If a device must keep using a password for now, give it a dedicated low-privilege mailbox used only for scanning, not a Global Admin or everyday user account. Old office-manager passwords left on devices are a common way offices lose control of Microsoft 365.

What if our office does not have a static public IP?

Direct send or an Exchange Online connector that trusts your office IP usually needs a static public IP. Many small offices on consumer or cable internet do not have one. In that case, ask your copier vendor about modern-auth or cloud scan features, use a dedicated mailbox with SMTP AUTH only as a short bridge, or change the workflow to scan to OneDrive or SharePoint.

Squared Away Tech serves offices of 5 to 100 people in the Tampa Bay and Sarasota area (Bradenton, Sarasota, Tampa, Ellenton, Lakewood Ranch, St. Petersburg, Palmetto, Venice and Parrish), serving small offices across Florida, and remotely anywhere in the U.S. Mon–Fri 5–9 PM and Sat 9 AM–5 PM (Eastern Time). Daytime and Sunday appointments available on request; daytime calls get a same-evening callback. Back to the home page · More guides

This guide is general information, not legal or insurance advice. Every office’s setup is different. Device support varies by manufacturer and firmware.