ScanRelay / Guides

Sharp MFP scan to email with Office 365 after Basic auth ends

Sharp's current BP-series manuals document OAuth 2.0 for sending through Microsoft 365. For older MX-series devices, and anything that can't get a token, a local SMTP relay keeps Scan to E-mail working.

What changes in December 2026

Microsoft's updated timeline (Exchange Team blog, January 27, 2026) says that at the end of December 2026, Basic authentication for SMTP AUTH is disabled by default in existing Exchange Online tenants. Admins can still turn it back on for the tenant or for single mailboxes. Tenants created after that date won't have it at all, and Microsoft will announce the final removal date in the second half of 2027.

Many Sharp devices are set up with smtp.office365.com, port 587, STARTTLS and a mailbox username and password. That's Basic auth. When it's turned off, scans fail at the send step. The device log or the SMTP conversation usually shows a 535 5.7.139 error.

Option 1: native OAuth 2.0 on current Sharp firmware

The BP-70C65 manual and the BP-70M65 manual say: "When using Microsoft365, Exchange Online, etc. to send e-mails from this machine, it is recommended to use the OAuth 2.0 authentication method." You pick OAuth 2.0 as the authentication method, choose the provider, enter the account name and click Get Token. That opens the provider's sign-in page. The token status then shows as Not Retrieved, Waiting for authorisation, Retrieved or Invalid. If you see a Token update failed error, delete the token and get a new one.

We couldn't find an official Sharp list of which older MX-series models or firmware versions support OAuth 2.0. If your device's SMTP page has no OAuth 2.0 option, ask your Sharp dealer whether firmware is available. If it isn't, use the relay option below.

Where the SMTP settings live in the Sharp web page (Settings, Administrator)

On BP-series models, the SMTP settings are under Settings (Administrator) > System Settings > Network Settings > Service Settings, on the SMTP tab (Sharp manual). That tab has the server, port, timeout, sender, SSL/TLS and authentication method. On older MX models the page and labels may be different, so check your model's manual.

Option 2: point the device at a local relay

If a device can't do OAuth, if the OAuth token keeps expiring, or if you run a mixed fleet and want one way to set everything up, point the device at a relay on your LAN. The device then sends plain SMTP to the relay, and the relay does the Microsoft 365 authentication. ScanRelay sends through Microsoft Graph as one mailbox you choose, so messages reach internal and external recipients, land in Sent Items, and need no DNS or SPF changes.

On a Sharp, go to the SMTP tab. Set the primary server to the relay and the port to 25, turn off SSL/TLS (unless the relay has a certificate), and set the authentication method to none or to the relay's per-device login. Enter a sender address, because it's required, but the relay replaces it with your sending mailbox.

1. Deploy the relay (Docker or LXC) and connect it to one sending mailbox. The README has the app registration and the RBAC for Applications commands.
2. Add the device's IP to SCANRELAY_ALLOW_IPS, or give it its own login.
3. Change only the SMTP host, port, TLS and authentication fields on the device, as shown in the table above.
4. Send a test scan to an internal and an external address, then check Sent Items on the sending mailbox.

Which option should you use?

• Current model with OAuth firmware available: use native OAuth. It's supported by the vendor and needs no extra box. Plan for the case where a token has to be re-authorized, for example after a password reset, a Conditional Access change or a long outage.
• Older model with no OAuth firmware: a relay (ScanRelay, or a Microsoft connector) is the realistic way to keep scan-to-email going. Scan to folder or SMB is another option.
• Mixed fleet or an MSP managing many sites: a relay per site means one set of settings for every brand, and one place to watch delivery logs and secret expiry.

Comparing every approach, including HVE, direct send and third-party senders? Read the hub guide.

Sources

1. Sharp BP-70C65 manual: OAuth 2.0 authentication
2. Sharp BP-70M65 manual: OAuth 2.0 authentication
3. Microsoft Learn: How to set up a multifunction device or application to send email using Microsoft 365
4. Microsoft Exchange Team: Updated SMTP AUTH Basic Authentication deprecation timeline
5. ScanRelay on GitHub