At the end of December 2026, Microsoft 365 switches off Basic authentication for SMTP AUTH by default. Copiers, MFPs and older apps that log in to smtp.office365.com with a password will stop sending. ScanRelay accepts their mail on your network and sends it from your own tenant through Microsoft Graph with OAuth. You don't need new hardware, DNS changes or a third-party sending service.
Messages go out as your real mailbox, get saved to Sent Items, and your retention, journaling and DLP rules still apply. SPF and DKIM already pass.
App-only Graph access is limited to one sending mailbox using Exchange RBAC for Applications. ScanRelay never has tenant-wide send-as, and it never stores message content.
One dashboard across every client tenant shows device health, delivery logs, and alerts before a client secret expires. Deploy it on-prem as Docker or LXC, or use our hosted relay.
Point the device at ScanRelay instead of smtp.office365.com. That's the only change on the device.
| ScanRelay | SendGrid / Mailgun / SMTP2GO | Microsoft HVE | |
|---|---|---|---|
| External recipients | Yes | Yes | No, internal only |
| Sends from your tenant (Sent Items, compliance) | Yes | No, a third party sends it | Yes |
| DNS / SPF changes needed | None | Yes | None |
| Multi-tenant MSP dashboard | Yes | No | No |
The self-hosted core will be free and open source. Beta testers get the first 3 tenants free.
Self-host, 1 tenant, open source.
Hosted relay, static IP, alerts, support.
15 tenants ($49) · 50 ($99) · unlimited ($199). Multi-tenant dashboard.
We're onboarding a small group of MSPs and IT admins in October. Tell us a bit about your environment.