Canon scan to email with Office 365 after Basic auth ends

Newer Canon firmware has a built-in OAuth 2.0 (Microsoft) setting for Exchange Online. Older and entry-level models may not have it. Those can keep scanning to email through a local SMTP relay.

What changes in December 2026

Microsoft's updated timeline (Exchange Team blog, January 27, 2026) says that at the end of December 2026, Basic authentication for SMTP AUTH is disabled by default in existing Exchange Online tenants. Admins can still turn it back on for the tenant or for single mailboxes. Tenants created after that date won't have it at all, and Microsoft will announce the final removal date in the second half of 2027.

Many Canon devices are set up with smtp.office365.com, port 587, STARTTLS and a mailbox username and password. That's Basic auth. When it's turned off, scans fail at the send step. The device log or the SMTP conversation usually shows a 535 5.7.139 error.

Option 1: native OAuth 2.0 on current Canon firmware

Canon's Remote UI manuals describe support for cloud mail servers using OAuth 2.0 with Microsoft Exchange Online. You configure it at Settings/Registration > Send > OAuth 2.0 (Microsoft) Settings, and the manual notes: "Configure this setting using Remote UI from a computer. You cannot use the control panel to configure the setting." Setup asks for the Microsoft Entra ID authorization endpoint (https://login.microsoftonline.com/<tenant>/oauth2/v2.0). The device then shows a user code that you enter at Microsoft's sign-in page. Success appears as Successfully Connected for the server and Active for the token.

The feature is documented in manuals for Canon's newer platforms, such as the imageRUNNER ADVANCE DX line (Remote UI Ver. 3.18 and later) and other models from Ver. 2.02. We couldn't find a single official Canon list of every supported model. Check your model's Remote UI manual, or ask your dealer about firmware. Two cautions: Canon says to set the device's date and time correctly before authorizing, and to redo the OAuth setup if you change them later. Canon community threads also report token errors after long power or internet outages, which need re-authorization. Some small-office imageCLASS models, such as the MF644Cdw in this thread, don't show the OAuth option at all.

Where the SMTP settings live in Remote UI

The path depends on the platform. On imageRUNNER ADVANCE / imagePRESS-class devices, Canon's manual gives Settings/Registration > Function Settings > Send > E-Mail/I-Fax Settings > Communication Settings (source). On some smaller models, Remote UI uses Settings/Registration > Network Settings > E-Mail/I-Fax Settings > Edit (source). There you'll find SMTP Server, Use SMTP Authentication (SMTP AUTH), Use TLS for SMTP and the POP-before-SMTP options. If neither path matches your device, the SMTP settings page is somewhere else on your model, so check its manual.

Option 2: point the device at a local relay

If a device can't do OAuth, if the OAuth token keeps expiring, or if you run a mixed fleet and want one way to set everything up, point the device at a relay on your LAN. The device then sends plain SMTP to the relay, and the relay does the Microsoft 365 authentication. ScanRelay sends through Microsoft Graph as one mailbox you choose, so messages reach internal and external recipients, land in Sent Items, and need no DNS or SPF changes.

Device field	Value when pointing at ScanRelay
SMTP server / host	The relay's LAN IP or DNS name (for example `10.0.20.5`), not `smtp.office365.com`
Port	`25`, or whichever host port you mapped to the container
SSL/TLS or STARTTLS	Off, unless you gave the relay a certificate (`SCANRELAY_TLS_CERT`). If you did, use STARTTLS
SMTP authentication	None, if the device's IP is in `SCANRELAY_ALLOW_IPS`. Otherwise the per-device login from `SCANRELAY_USERS`
From / device email address	Anything sensible. The relay rewrites From to your sending mailbox and keeps the device address as Reply-To

On a Canon, set SMTP Server to the relay address. Turn off Use SMTP Authentication (allowlisted IP) or enter the relay login. Turn off Use TLS for SMTP unless the relay has a certificate, and turn off POP authentication before sending. If your model has a separate port field, set it to 25.

Deploy the relay (Docker or LXC) and connect it to one sending mailbox. The README has the app registration and the RBAC for Applications commands.
Add the device's IP to SCANRELAY_ALLOW_IPS, or give it its own login.
Change only the SMTP host, port, TLS and authentication fields on the device, as shown in the table above.
Send a test scan to an internal and an external address, then check Sent Items on the sending mailbox.

Which option should you use?

Current model with OAuth firmware available: use native OAuth. It's supported by the vendor and needs no extra box. Plan for the case where a token has to be re-authorized, for example after a password reset, a Conditional Access change or a long outage.
Older model with no OAuth firmware: a relay (ScanRelay, or a Microsoft connector) is the realistic way to keep scan-to-email going. Scan to folder or SMB is another option.
Mixed fleet or an MSP managing many sites: a relay per site means one set of settings for every brand, and one place to watch delivery logs and secret expiry.

Comparing every approach, including HVE, direct send and third-party senders? Read the hub guide.

Keep older scanners sending, without a third-party mail service

ScanRelay takes plain SMTP from devices on your LAN and sends it as your own mailbox through Microsoft Graph with OAuth. It's open source and self-hostable. The hosted relay and MSP dashboard are in beta from October 2026.

Join the beta View on GitHub