Scan-to-email cutover checklist for MSPs
A site-by-site runbook for moving copiers and scanners off Microsoft 365 SMTP Basic auth before it's turned off by default at the end of December 2026. Use it whether each device ends up on OAuth firmware or on a local relay.
Before you touch a device
- Inventory the senders. Run the SMTP AUTH clients report and check the Entra sign-in logs, as in Find devices still using SMTP AUTH Basic. Record each device's make, model, firmware, IP, and the mailbox it signs in as.
- Record the current settings. Screenshot or export each device's email server page (host, port, security, username) so you can roll back.
- Note who uses each device for what. Scan-to-email, fax-to-email and alert email often share one mailbox. List the recipients that matter, including any external ones such as an accountant or a lab.
- Pick a fix per device. OAuth 2.0 in the device's own web page if the model supports it, a relay if it doesn't, or scan to folder or cloud if email isn't really needed. The hub guide compares the options.
Per-site relay rollout
If a site has devices that can't do OAuth, one relay can serve every device there.
- Deploy the relay (Docker or LXC) on a host that stays up. The ScanRelay README covers the app registration and the RBAC for Applications scoping, so the relay can send only as the mailbox you choose.
- Allow each device by IP with
SCANRELAY_ALLOW_IPS, or give devices their own logins withSCANRELAY_USERS. - If devices should use STARTTLS on the LAN, give the relay a certificate with
SCANRELAY_TLS_CERT. - On each device, change only the server, port, security and authentication fields. Leave address books and scan profiles alone.
Test every device the same way
| Test | Pass when |
|---|---|
| Scan to an internal address | It arrives, and the sender is the sending mailbox |
| Scan to an external address | It arrives and isn't in junk |
| Multi-page scan near the device's size limit | It arrives whole |
| Reply to the received scan | The reply goes where the site expects (with ScanRelay, the device address is kept as Reply-To) |
| Sent Items on the sending mailbox | The test messages are there |
| Fax-to-email or device alerts, if used | They still arrive |
After the cutover
- Once every device on a mailbox has moved, turn SMTP AUTH back off for that mailbox if you had re-enabled it as a stopgap (see 535 5.7.139).
- Note which devices use OAuth. Tokens can lapse after long idle periods and need an admin to sign in again.
- Keep the rollback screenshots until the site has run a full billing cycle without complaints.
- Recheck the SMTP AUTH clients report a week later. Anything still listed was missed.
Brand-specific steps: HP, Canon, Ricoh, Xerox, Kyocera, Konica Minolta, Sharp, Brother, Toshiba, Lexmark, Epson.
Keep older scanners sending, without a third-party mail service
ScanRelay takes plain SMTP from devices on your LAN and sends it as your own mailbox through Microsoft Graph with OAuth. It's open source and self-hostable. The hosted relay and MSP dashboard are in beta from October 2026.
Join the betaView on GitHub