Kyocera scan to email with Office 365 after Basic auth ends
Current Kyocera TASKalfa and ECOSYS models support OAuth 2.0 for Microsoft 365 natively. For models that won't get it, Kyocera offers its own connector utility, and a local relay is another option.
What changes in December 2026
Microsoft's updated timeline (Exchange Team blog, January 27, 2026) says that at the end of December 2026, Basic authentication for SMTP AUTH is disabled by default in existing Exchange Online tenants. Admins can still turn it back on for the tenant or for single mailboxes. Tenants created after that date won't have it at all, and Microsoft will announce the final removal date in the second half of 2027.
Many Kyocera devices are set up with smtp.office365.com, port 587, STARTTLS and a mailbox username and password. That's Basic auth. When it's turned off, scans fail at the send step. The device log or the SMTP conversation usually shows a 535 5.7.139 error.
Option 1: native OAuth 2.0 on current Kyocera firmware
Kyocera's OAuth 2.0 support announcement lists native OAuth 2.0 for SMTP and POP3 on ECOSYS models such as the PA4000x, MA4000x/fx, MA2101cfx, MA2600cfx and PA3500cx–PA6000x, and on TASKalfa models such as the MZ2501ci–MZ7001ci, MZ5001i–MZ7001i, 2554ci–7054ci and 5004i–7004i, among others. For devices "not scheduled to support OAuth2.0", Kyocera points to its Kyocera Exchange Online Connector Utility. That's a Kyocera-supported alternative to a third-party relay, and worth comparing if your fleet is all Kyocera.
A Kyocera Belgium how-to describes the native setup: register an Entra app with SMTP.Send and admin consent, then enter the client ID, secret and tenant ID on the device with smtp.office365.com, port 587, STARTTLS. Watch the secret's expiry date, because the device stops sending when it expires.
Where the SMTP settings live in Command Center RX
In Command Center RX, Kyocera's user guide says to click E-mail under Function Settings in the navigation menu (Command Center RX User Guide). Some regional guides call it Function Menu > E-mail (Kyocera AU). That page has the SMTP Server Name, SMTP Port Number, Authentication Protocol, login user name and password, and SSL/TLS settings.
Option 2: point the device at a local relay
If a device can't do OAuth, if the OAuth token keeps expiring, or if you run a mixed fleet and want one way to set everything up, point the device at a relay on your LAN. The device then sends plain SMTP to the relay, and the relay does the Microsoft 365 authentication. ScanRelay sends through Microsoft Graph as one mailbox you choose, so messages reach internal and external recipients, land in Sent Items, and need no DNS or SPF changes.
| Device field | Value when pointing at ScanRelay |
|---|---|
| SMTP server / host | The relay's LAN IP or DNS name (for example 10.0.20.5), not smtp.office365.com |
| Port | 25, or whichever host port you mapped to the container |
| SSL/TLS or STARTTLS | Off, unless you gave the relay a certificate (SCANRELAY_TLS_CERT). If you did, use STARTTLS |
| SMTP authentication | None, if the device's IP is in SCANRELAY_ALLOW_IPS. Otherwise the per-device login from SCANRELAY_USERS |
| From / device email address | Anything sensible. The relay rewrites From to your sending mailbox and keeps the device address as Reply-To |
On a Kyocera, go to Function Settings, then E-mail. Set SMTP Server Name to the relay and SMTP Port Number to 25, turn off SMTP security (SSL/TLS), and set Authentication Protocol to Off (allowlisted IP) or to the relay login. Set the Sender Address, though the relay rewrites it.
- Deploy the relay (Docker or LXC) and connect it to one sending mailbox. The README has the app registration and the RBAC for Applications commands.
- Add the device's IP to
SCANRELAY_ALLOW_IPS, or give it its own login. - Change only the SMTP host, port, TLS and authentication fields on the device, as shown in the table above.
- Send a test scan to an internal and an external address, then check Sent Items on the sending mailbox.
Which option should you use?
- Current model with OAuth firmware available: use native OAuth. It's supported by the vendor and needs no extra box. Plan for the case where a token has to be re-authorized, for example after a password reset, a Conditional Access change or a long outage.
- Older model with no OAuth firmware: a relay (ScanRelay, or a Microsoft connector) is the realistic way to keep scan-to-email going. Scan to folder or SMB is another option.
- Mixed fleet or an MSP managing many sites: a relay per site means one set of settings for every brand, and one place to watch delivery logs and secret expiry.
Comparing every approach, including HVE, direct send and third-party senders? Read the hub guide.
Keep older scanners sending, without a third-party mail service
ScanRelay takes plain SMTP from devices on your LAN and sends it as your own mailbox through Microsoft Graph with OAuth. It's open source and self-hostable. The hosted relay and MSP dashboard are in beta from October 2026.
Join the betaView on GitHubSources
- Kyocera Document Solutions UK: Kyocera OAuth2.0 authentication support
- Kyocera Belgium: How to Kyocera scan to mail via OAuth2.0 (PDF)
- Kyocera Command Center RX User Guide (PDF)
- Kyocera Document Solutions Australia: Set up scan to email via Command Centre
- Microsoft Exchange Team: Updated SMTP AUTH Basic Authentication deprecation timeline
- ScanRelay on GitHub