“SmtpClientAuthentication is disabled for the Tenant” / 535 5.7.139 Authentication unsuccessful

If a copier, scanner or script that sends through smtp.office365.com suddenly fails with a 535 5.7.139 error, Exchange Online is refusing its username-and-password login. Here's what each variant means and how to fix it for good.

The exact error strings

These are the variants admins report most often, taken from Microsoft Q&A and vendor knowledge bases (sources below):

535 5.7.139 Authentication unsuccessful, SmtpClientAuthentication is disabled for the Tenant.
535 5.7.139 Authentication unsuccessful, basic authentication is disabled.
535 5.7.139 Authentication unsuccessful, the request did not meet the criteria to be authenticated successfully.

Devices often shorten these or show their own codes instead, such as "Authentication Error", "SMTP authentication failed" or a numeric code on the panel. If you can, check the SMTP transcript or the device's job log for the 535 line. You might also see 530 5.7.57 Client not authenticated to send mail when a device doesn't try to authenticate at all. From the end of December 2026, SMTP AUTH Basic auth is disabled by default, so expect many more of these. Microsoft may also word the messages slightly differently after that change.

What each one means

"SmtpClientAuthentication is disabled for the Tenant": SMTP AUTH is turned off for the whole organization (SmtpClientAuthenticationDisabled = True on the transport config), and the mailbox doesn't override it.
"basic authentication is disabled": SMTP AUTH may be allowed, but Basic auth isn't, for example because of Security Defaults, an authentication policy, or the December 2026 default.
"the request did not meet the criteria to be authenticated successfully": usually Security Defaults, a Conditional Access policy, MFA on the account, or a per-mailbox setting blocking the sign-in. Check the Entra sign-in logs for the account.

Check the current settings

Connect-ExchangeOnline
Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled
Get-CASMailbox -Identity [email protected] | Format-List SmtpClientAuthenticationDisabled

On the mailbox, $null means it follows the tenant setting. Microsoft notes that if Security Defaults are on, SMTP AUTH is already disabled, and that an authentication policy blocking Basic auth for SMTP overrides these settings.

Fix 1 (temporary): re-enable SMTP AUTH for one mailbox

Set-CASMailbox -Identity [email protected] -SmtpClientAuthenticationDisabled $false

This works for existing tenants until Microsoft's final removal date, which it will announce in the second half of 2027. It doesn't work in tenants created after December 2026, or while Security Defaults are on. It also leaves a password-only mailbox that can't use MFA, which is exactly what Microsoft is trying to get rid of. Use it to buy a few weeks, not as the fix.

Fix 2: switch the device to OAuth 2.0

If your device's firmware supports Microsoft OAuth, update the firmware and redo the SMTP setup with OAuth. Current Ricoh, Konica Minolta, Xerox, Kyocera, Canon, Sharp, Brother and HP Enterprise models often do. Our brand guides link each vendor's support list and settings page.

Fix 3: send through a relay that authenticates for the device

For devices that will never get OAuth firmware, point them at a relay. The device sends plain SMTP on the LAN, and the relay authenticates to Microsoft 365 with modern auth. ScanRelay sends through Microsoft Graph as one mailbox, reaches external recipients, and needs no DNS changes. You change four fields on the device: host, port, TLS and authentication.

Other options

Microsoft HVE only delivers to internal recipients. Direct send only delivers internally and is often blocked. A connector relay needs a static IP. Third-party senders need DNS changes. The hub guide compares all of them.

Don't fix this by turning off Security Defaults for the whole tenant just to get one scanner working. That weakens sign-in protection for every user.

Keep older scanners sending, without a third-party mail service

ScanRelay takes plain SMTP from devices on your LAN and sends it as your own mailbox through Microsoft Graph with OAuth. It's open source and self-hostable. The hosted relay and MSP dashboard are in beta from October 2026.

Join the beta View on GitHub