Fujifilm Apeos scan-to-email with Microsoft 365
How to keep scan-to-email working on Fujifilm Apeos, ApeosPort and older Fuji Xerox DocuCentre devices when Microsoft 365 stops accepting SMTP AUTH with a username and password. Microsoft has said Basic auth for SMTP AUTH will be turned off by default for existing tenants at the end of December 2026.
Check your model first. Fujifilm has added OAuth 2.0 sign-in for Microsoft 365 to some recent Apeos models through firmware updates, but not to every model or every firmware level, and older DocuCentre devices generally don't have it. Look at your model's firmware release notes or ask your Fujifilm dealer before you plan around it.
Step 1: find out what the device is doing now
- Open the device's web page (CentreWare Internet Services or Internet Services) by typing its IP address into a browser and signing in as the machine administrator.
- Find the outgoing mail (SMTP) settings. On many models they sit under the network or protocol settings, in an SMTP or E-mail section. Menu names vary by model and firmware.
- Write down the server, port, encryption setting, authentication method and the account it signs in as. Screenshot the page so you can roll back.
- Confirm in Microsoft 365 that this account shows up as an SMTP AUTH client, as in Find devices still using SMTP AUTH Basic.
Step 2: pick a fix
| Option | When it fits | Watch out for |
|---|---|---|
| OAuth 2.0 on the device | Your model and firmware list Microsoft 365 OAuth support | Firmware updates can change other settings; tokens may need an admin to sign in again after long idle periods |
| Local relay (such as ScanRelay) | The device has no OAuth option, or you want one fix for a mixed fleet | You need a small always-on host on the same network |
| Microsoft 365 connector or direct send | You only scan to internal mailboxes and have a static public IP | Direct send can't reach external recipients and is being tightened; see Reject Direct Send |
| Scan to folder or cloud | Users don't really need email | Changes the workflow for staff |
Step 3a: if the device supports OAuth 2.0
- Update the firmware to a level whose release notes list Microsoft 365 OAuth.
- In the device's SMTP settings, choose the OAuth 2.0 or Microsoft 365 sign-in option, then sign in with the mailbox the device should send as. Follow the steps in your model's administrator guide; the exact screens differ between models.
- Send a test scan to an internal and an external address.
Step 3b: if it doesn't, point it at a relay
Deploy the relay on a host that stays up (the ScanRelay README covers Docker, LXC, the app registration and RBAC for Applications scoping). Then change only these fields on the device:
| Field | Value |
|---|---|
| SMTP server | The relay host's LAN IP or name |
| Port | The port you set on the relay (25 or 587 are common) |
| Encryption | STARTTLS if you gave the relay a certificate with SCANRELAY_TLS_CERT, otherwise none on the LAN |
| Authentication | None if you allow the device by IP with SCANRELAY_ALLOW_IPS, or the per-device login from SCANRELAY_USERS |
| Device e-mail address | Leave as is; ScanRelay keeps it as Reply-To |
Leave the address book and scan profiles alone. Then run the test table in the cutover checklist.
Common errors
- 535 5.7.139: SMTP AUTH is off for the tenant or mailbox. See 535 5.7.139.
- Scans to outside addresses never arrive after moving to a connector or direct send: that route only delivers inside your tenant. Use OAuth or a relay.
- Large scans fail: check the device's maximum message size and split setting against the mailbox's send limit.
Other brands: Xerox, Canon, Ricoh, Konica Minolta, Kyocera, Sharp, Toshiba, HP, Brother, Lexmark, Epson.
Keep older scanners sending, without a third-party mail service
ScanRelay takes plain SMTP from devices on your LAN and sends it as your own mailbox through Microsoft Graph with OAuth. It's open source and self-hostable. The hosted relay and MSP dashboard are in beta from October 2026.
Join the betaView on GitHub