“550 5.7.30 Basic authentication is not supported for Client Submission” (fix)

This is the rejection Exchange Online returns when a device or script logs in to smtp.office365.com with a username and password after Basic auth for SMTP AUTH has been switched off. Microsoft switches it off by default for existing tenants at the end of December 2026, so expect to see it on copiers, line-of-business apps and alert scripts from then on.

The exact error

550 5.7.30 Basic authentication is not supported for Client Submission.

It's a permanent (5xx) rejection. The sender doesn't retry, so the scan or alert is simply lost. Many copiers only show a generic "send failed" or "server connection error" on the panel; the 550 5.7.30 text is in the device's job log or the app's SMTP log.

Seeing 535 5.7.139 instead? That's the older "SMTP AUTH is disabled for the tenant / mailbox" family. The cause and the fixes are the same. See 535 5.7.139 Authentication unsuccessful.

Why it starts now: the timeline

When	What happens
Until end of December 2026	No change. Basic auth over SMTP AUTH keeps working where it's enabled.
End of December 2026	Basic auth for SMTP AUTH is disabled by default in existing tenants. Admins can still turn it back on.
Tenants created after that	Basic auth for SMTP AUTH isn't available by default. OAuth only.
Second half of 2027	Microsoft announces the final removal date. After that, there's no switch to turn it back on.

Only client submission (an authenticated login to smtp.office365.com on 587/25) is affected. An Exchange Online connector that relays by IP or certificate on port 25 is a different path and isn't part of this change.

Step 1: find what's sending with Basic auth

Exchange admin center ▸ Reports ▸ Mail flow ▸ SMTP AUTH clients. Filter on Basic authentication. That gives you the accounts, and usually enough to find the device.
Entra ID sign-in logs, filtered to Client app = Authenticated SMTP, give source IPs.
Full checklist: Find devices still using SMTP AUTH Basic.

Step 2: pick a permanent fix per sender

Sender	Fix
Copier or MFP with OAuth 2.0 (Modern Auth) firmware	Update the firmware and switch the SMTP account to OAuth. Brand guides: Ricoh, Canon, Konica Minolta, Xerox, HP, all brands.
Older device with no OAuth, sending only inside the company	Microsoft's High Volume Email (HVE) still accepts a password, but only for internal recipients.
Older device that sends outside the company	A local relay. The device sends plain SMTP on the LAN, and the relay sends it on with OAuth (Microsoft Graph or SMTP OAuth). ScanRelay is one; Microsoft also documents a connector-based relay.
Scripts, cron jobs, monitoring alerts	Send through Microsoft Graph `sendMail` with an app registration scoped to one mailbox. `scanrelay-send` is a drop-in `sendmail` replacement that does this.
Apps that support OAuth SMTP	Switch them to OAuth 2.0 (XOAUTH2) with the SMTP.Send or SMTP.SendAsApp permission.

Stopgap: turning it back on (until 2027)

After the December default change, admins can re-enable Basic auth for SMTP AUTH to buy time, using the tenant and mailbox SMTP AUTH settings and any authentication policy that blocks it (check Get-TransportConfig | fl SmtpClientAuthenticationDisabled, Get-CASMailbox <account> | fl SmtpClientAuthenticationDisabled and the AllowBasicAuthSmtp setting on authentication policies). Treat this as a few months at most: Microsoft support won't grant exceptions, and the switch goes away when the final removal date lands.

MSP tip: do the inventory once per client tenant now, before the default flips. Re-enabling across dozens of tenants in January is the expensive way to do it. The cutover checklist has a per-site test table.

Keep older scanners sending, without a third-party mail service

ScanRelay takes plain SMTP from devices on your LAN and sends it as your own mailbox through Microsoft Graph with OAuth, scoped to one mailbox. It's open source and self-hostable. The hosted relay and MSP dashboard are in beta.

Join the beta View on GitHub