Toshiba e-STUDIO scan to email with Office 365 after Basic auth ends

Most current Toshiba e-STUDIO models can send through Microsoft 365 with OAuth 2.0 after a firmware update, using TopAccess's Cloud Authentication for Email. A few models can't, and for those, plus anything stuck on old firmware, a local SMTP relay keeps Scan to E-mail working.

What changes in December 2026

Microsoft's updated timeline (Exchange Team blog, January 27, 2026) says that at the end of December 2026, Basic authentication for SMTP AUTH is disabled by default in existing Exchange Online tenants. Admins can still turn it back on for the tenant or for single mailboxes. Tenants created after that date won't have it at all, and Microsoft will announce the final removal date in the second half of 2027.

Many e-STUDIO devices are set up in TopAccess with smtp.office365.com, port 587, STARTTLS and a mailbox login name and password. That's Basic auth. When it's turned off, scans fail at the send step, often with a 535 5.7.139 error in the SMTP conversation.

Which e-STUDIO models support OAuth 2.0

Toshiba Tec published a compatibility table for the Exchange Online changes (Toshiba Tec notice, January 2026). In summary:

Models	OAuth 2.0 to Exchange Online
e-STUDIO 2020AC, 2525AC/3025AC/3525AC/4525AC/5525AC/6525AC and the 6526AC/6527AC/7527AC line	Compatible after a firmware update (Toshiba lists December 2023 and April 2024 releases)
e-STUDIO 2528A to 9029A series	Compatible after a firmware update (December 2023)
e-STUDIO 331AC, 401AC	Compatible since initial release
Newer S-series (for example 408S, 409S)	Compatible with firmware released July to September 2025
e-STUDIO 3508LP, 4508LP, 5008LP	Email reception only, per Toshiba
e-STUDIO 301DN, 302DNF, 1058, 1208	Not compatible. Toshiba suggests changing to another email service

This is a summary; check the full table for your exact model before planning, and ask your Toshiba dealer for the firmware. Toshiba's Australian setup guide gives firmware 1801 as the minimum for e-BRIDGE Next Series III models (Toshiba setup guide).

Option 1: native OAuth 2.0 (Cloud Authentication for Email)

On supported firmware, Toshiba's guide sets this up in TopAccess under Administration > Setup > Network > SMTP Client:

TopAccess field	Value for Microsoft 365 OAuth
Enable SMTP Client	Enable
SMTP Server	`smtp.office365.com`, port `587`
Authentication	Application
Login Name	The Microsoft 365 mailbox address the device sends as
Password	Leave blank

Save, then click Assignment and choose Cloud Authentication for Email. You sign in to Microsoft, review the permissions and consent, and the device is registered to send as that mailbox. Note that this still uses SMTP AUTH, just with OAuth instead of a password, so SMTP AUTH must stay enabled for that mailbox, and your Conditional Access policies must allow the sign-in.

Option 2: point the e-STUDIO at a local relay

Use a relay if the model is on the not-compatible list, if the dealer can't get you the firmware before December, if the device is leased and nobody will touch it, or if you manage a mixed fleet and want one setup for every brand. The device sends plain SMTP to the relay on your LAN, and the relay does the Microsoft 365 authentication. ScanRelay sends through Microsoft Graph as one mailbox you choose, so messages reach internal and external recipients, land in Sent Items, and need no DNS or SPF changes.

TopAccess SMTP Client field	Value when pointing at ScanRelay
SMTP Server	The relay's LAN IP or DNS name (for example `10.0.20.5`), not `smtp.office365.com`
Port	`25`, or whichever host port you mapped to the container
SSL/TLS	Off, unless you gave the relay a certificate (`SCANRELAY_TLS_CERT`). If you did, use STARTTLS
Authentication	Off, if the device's IP is in `SCANRELAY_ALLOW_IPS`. Otherwise the per-device login from `SCANRELAY_USERS`
Device e-mail address (From)	Anything sensible. The relay rewrites From to your sending mailbox and keeps the device address as Reply-To

Deploy the relay (Docker or LXC) and connect it to one sending mailbox. The README has the app registration and the RBAC for Applications commands.
Add the e-STUDIO's IP to SCANRELAY_ALLOW_IPS, or give it its own login.
In TopAccess, change only the SMTP Server, Port, SSL/TLS and Authentication fields, as shown above. Leave the Cloud Authentication assignment empty.
Send a test scan to an internal and an external address, then check Sent Items on the sending mailbox.

Which option should you use?

Model on Toshiba's compatible list and firmware available: use Cloud Authentication for Email. It's vendor-supported and needs no extra box. Plan for re-consent after password resets or Conditional Access changes.
301DN, 302DNF, 1058, 1208, or no firmware in time: a relay (ScanRelay, or a Microsoft connector) keeps scan-to-email going. Scan to folder or SMB is another option.
Mixed fleet or an MSP managing many sites: a relay per site means one set of settings for every brand, and one place to watch delivery logs and secret expiry.

Not sure which devices still log in with a password? Start with finding every device still using SMTP AUTH Basic, or compare every approach in the hub guide.

Keep older scanners sending, without a third-party mail service

ScanRelay takes plain SMTP from devices on your LAN and sends it as your own mailbox through Microsoft Graph with OAuth. It's open source and self-hostable. The hosted relay and MSP dashboard are in beta from October 2026.

Join the beta View on GitHub