Lexmark scan to email with Office 365 after Basic auth ends
Lexmark's current user guides describe an OAuth 2.0 option for Outlook / Microsoft 365 in the Embedded Web Server. Older models, or fleets you'd rather not re-register one by one, can send through a local relay instead.
What changes in December 2026
Microsoft's updated timeline (Exchange Team blog, January 27, 2026) says that at the end of December 2026, Basic authentication for SMTP AUTH is disabled by default in existing Exchange Online tenants. Admins can still turn it back on for the tenant or for single mailboxes. Tenants created after that date won't have it at all, and Microsoft will announce the final removal date in the second half of 2027.
A Lexmark set up with smtp.office365.com, port 587 and SMTP Server Authentication set to Login / Plain with a mailbox password is using Basic auth. When it's turned off, scans fail at the send step, usually with a 535 5.7.139 error.
Option 1: OAuth 2.0 in the Embedded Web Server
Lexmark's guide Configuring the email SMTP settings describes the setup:
- Browse to the printer's IP address to open the Embedded Web Server.
- Go to Settings > Email.
- Click Set Up OAuth 2 for Email Server, then Register.
- Enter the code the Embedded Web Server shows, sign in to the Microsoft account, and follow the prompts.
Lexmark lists these values for Outlook / Microsoft 365 with OAuth 2.0:
| Field | OAuth 2.0 value (per Lexmark) |
|---|---|
| Primary SMTP Gateway | smtp.office365.com |
| Port | 587 |
| Use SSL/TLS | Required |
| Reply Address | The address used to register OAuth 2.0 |
| SMTP Server Authentication | OAuth2.0 |
Things to check first:
- Update the printer firmware. Lexmark's guide tells you to do this before setup, and the OAuth option appears only on models and firmware that support it.
- The on-printer email setup wizard does not apply to OAuth 2.0. Use the Embedded Web Server.
- Your tenant may require admin consent before the device can be registered. Have someone with an Entra admin role ready.
Option 2: point the device at a local relay
If a model has no OAuth option, if you manage many sites, or if you run a mixed fleet, point the Lexmark at a relay on your LAN. The device sends plain SMTP to the relay, and the relay does the Microsoft 365 authentication. ScanRelay sends through Microsoft Graph as one mailbox you choose, so messages reach internal and external recipients, land in Sent Items, and need no DNS or SPF changes.
| Device field | Value when pointing at ScanRelay |
|---|---|
| Primary SMTP Gateway | The relay's LAN IP or DNS name (for example 10.0.20.5), not smtp.office365.com |
| Primary SMTP Gateway Port | 25, or whichever host port you mapped to the container |
| Use SSL/TLS | Disabled, unless you gave the relay a certificate (SCANRELAY_TLS_CERT). If you did, use Negotiate / STARTTLS |
| SMTP Server Authentication | No authentication required, if the device's IP is in SCANRELAY_ALLOW_IPS. Otherwise Login / Plain with the per-device login from SCANRELAY_USERS |
| Reply Address | Anything sensible. The relay rewrites From to your sending mailbox and keeps the device address as Reply-To |
- Deploy the relay (Docker or LXC) and connect it to one sending mailbox. The README has the app registration and the RBAC for Applications commands.
- Add the device's IP to
SCANRELAY_ALLOW_IPS, or give it its own login. - In the Embedded Web Server, under Settings > Email, change only the gateway, port, SSL/TLS and authentication fields as shown above.
- Send a test scan to an internal and an external address, then check Sent Items on the sending mailbox.
Which option should you use?
- Model with "Set Up OAuth 2 for Email Server": use it. It's vendor-supported and needs no extra box.
- Model with no OAuth option: a relay (ScanRelay, or a Microsoft connector) is the realistic way to keep scan-to-email going. Scan to folder or cloud is another option.
- Mixed fleet or an MSP managing many sites: a relay per site means one set of settings for every brand, and one place to watch delivery logs.
Comparing every approach, including HVE, direct send and third-party senders? Read the hub guide.
Keep older scanners sending, without a third-party mail service
ScanRelay takes plain SMTP from devices on your LAN and sends it as your own mailbox through Microsoft Graph with OAuth. It's open source and self-hostable. The hosted relay and MSP dashboard are in beta from October 2026.
Join the betaView on GitHub