Epson scan to email with Office 365 after Basic auth ends

Many current Epson printers and document scanners can sign in to Exchange Online with OAuth 2.0 from Web Config. Older models, or devices you'd rather not re-authorize by hand, can send through a local relay instead.

What changes in December 2026

Microsoft's updated timeline (Exchange Team blog, January 27, 2026) says that at the end of December 2026, Basic authentication for SMTP AUTH is disabled by default in existing Exchange Online tenants. Admins can still turn it back on for the tenant or for single mailboxes. Tenants created after that date won't have it at all, and Microsoft will announce the final removal date in the second half of 2027.

An Epson set up with smtp.office365.com, port 587, STARTTLS and a mailbox username and password is using Basic auth. When it's turned off, scans fail at the send step, usually with a 535 5.7.139 error.

Option 1: OAuth 2.0 in Web Config

Epson's user guides (for example the AM-C10000 series and the DS-800WN scanner) describe the setup:

Open Web Config by browsing to the device's IP address and log in as administrator.
Go to Network tab > Email Server > Basic.
Set Authentication Method to OAuth2 and choose Microsoft Exchange Online as the email service (Outlook.com is for personal accounts).
Sign in with the Microsoft account the device will send as, and grant consent on behalf of the organization.

Things to check before you start, all from Epson's documentation:

The person granting consent needs the Cloud Application Administrator role (or higher) in Entra ID.
Update to the latest firmware. Epson's Device Authentication Guide for Microsoft Exchange Online says OAuth is for compatible models only.
On models with an optional Ethernet board, OAuth2 works only on the built-in LAN port.
If the device or its email function isn't used for a long time, the access and refresh tokens become invalid and an administrator has to sign in again.

Option 2: point the device at a local relay

If a model has no OAuth option, if you don't want to re-sign-in devices after tokens lapse, or if you run a mixed fleet, point the Epson at a relay on your LAN. The device sends plain SMTP to the relay, and the relay does the Microsoft 365 authentication. ScanRelay sends through Microsoft Graph as one mailbox you choose, so messages reach internal and external recipients, land in Sent Items, and need no DNS or SPF changes.

Device field	Value when pointing at ScanRelay
SMTP server / host	The relay's LAN IP or DNS name (for example `10.0.20.5`), not `smtp.office365.com`
Port	`25`, or whichever host port you mapped to the container
Secure connection	None, unless you gave the relay a certificate (`SCANRELAY_TLS_CERT`). If you did, use STARTTLS
Authentication method	Off, if the device's IP is in `SCANRELAY_ALLOW_IPS`. Otherwise SMTP AUTH with the per-device login from `SCANRELAY_USERS`
Sender's email address	Anything sensible. The relay rewrites From to your sending mailbox and keeps the device address as Reply-To

Deploy the relay (Docker or LXC) and connect it to one sending mailbox. The README has the app registration and the RBAC for Applications commands.
Add the device's IP to SCANRELAY_ALLOW_IPS, or give it its own login.
In Web Config, under Network > Email Server > Basic, change only the server, port, secure connection and authentication fields as shown above.
Send a test scan to an internal and an external address, then check Sent Items on the sending mailbox.

Which option should you use?

Model with OAuth2 in Web Config: use it. It's vendor-supported and needs no extra box. Note who holds the admin role, because tokens can lapse and need a fresh sign-in.
Model with no OAuth option: a relay (ScanRelay, or a Microsoft connector) is the realistic way to keep scan-to-email going. Scan to folder or cloud is another option.
Mixed fleet or an MSP managing many sites: a relay per site means one set of settings for every brand, and one place to watch delivery logs.

Comparing every approach, including HVE, direct send and third-party senders? Read the hub guide.

Keep older scanners sending, without a third-party mail service

ScanRelay takes plain SMTP from devices on your LAN and sends it as your own mailbox through Microsoft Graph with OAuth. It's open source and self-hostable. The hosted relay and MSP dashboard are in beta from October 2026.

Join the beta View on GitHub