Scan to email 365: finish Microsoft 365 setup with OAuth2 or relay

The copier says the scan went. Then nothing lands. Front desk is waiting on an invoice. You are in the printer menu, Microsoft 365, and a vendor PDF, and none of them agree on the port. That stuck feeling is common. Scan to email 365 is three methods, not one. Pick the method that matches the hardware, then test a real scan.

• Ask if the device can do OAuth2. If it can, Client SMTP on port 587 is usually the right first try.
• Ask if scans need to leave the building. Clients and suppliers need Client SMTP or a relay. Direct Send will not reach them.
• Ask if this is one machine or a fleet. Older copiers across a few sites usually want a relay connector, not a password in every panel.
• Send a test to a real inbox. A green tick on the printer is not proof.

If mail still will not send, stop guessing the next vendor article. Email Systems Scientist covers Microsoft 365 scan-to-email across NSW. Sydney offices can start with email help across Sydney. Central Coast sites can use email help on the Central Coast.

Which scan to email 365 method should you choose?

Microsoft 365 gives a multifunction printer three ways to send a scanned PDF. Picking the wrong one is the usual reason the first attempt fails. The methods trade off device support, security, and who you can actually email.

• Client SMTP submission (OAuth2, or basic auth if that is all the device has): Uses smtp.office365.com on port 587. Best for a modern copier that needs internal and external recipients. Needs a mailbox. OAuth2 on the device is the cleaner login.
• SMTP relay via a connector: No mailbox password on the printer. Handles more volume. Suits older hardware and fleets. Needs a static public IP or a certificate, and the right SPF record.
• Direct Send: No login at all. Sends to your tenant MX on port 25. Only reaches people inside your own Microsoft 365 tenant. It is the flakiest of the three on a shared or dynamic IP.

Ask those three questions before you open a settings menu. One small office with a recent HP or Kyocera should default to Client SMTP with OAuth2. Five-year-old copiers across a few sites usually want a relay, if you have a fixed IP to hang it on. If scans never leave the building, Direct Send is less fuss. The moment someone asks to scan straight to a client, Direct Send is the wrong answer.

If Outlook itself is the problem, not the copier, that is a different job. Start with Outlook not receiving emails first.

Set up Client SMTP submission

This is the method Microsoft Learn puts first for devices that can do modern authentication. It is also what most office scanners try out of the box.

1. In the Microsoft 365 admin centre, go to Users, Active users. Open the mailbox you will use for scanning. Then Mail, Manage email apps, and switch on Authenticated SMTP.
2. On the device, set the outgoing server to smtp.office365.com, port 587, with STARTTLS on. Do not use port 465. It is not the supported client submission port, and it can fail with no useful error.
3. Enter the mailbox address as the username, then the account password or an OAuth2 token, depending on what the panel offers.
4. Send a test scan. The From address should match the login mailbox, or that mailbox needs Send As rights if the From is different.

Use a dedicated shared mailbox, not someone's personal inbox. Device traffic stays out of a real person's mail. Licensing is simpler. Send As is easier to manage. Kyocera's Australian setup notes treat that as standard practice.

Pro Tip: If scans stop after a tenant move or a licence change, check Authenticated SMTP first. It is often off by default, and it is the usual reason a setup that used to work fails overnight.

Configure SMTP relay for older or fleet devices

SMTP relay skips a password on every copier. That is the practical choice when you have several MFPs, or hardware that predates OAuth2. It also copes with higher volume, and it can send from addresses that are not a real mailbox.

1. In the Exchange admin centre, create a new inbound connector.
2. Pick the authentication: certificate-based (Microsoft's preferred option) or IP-based, depending on what the network allows.
3. If you go IP-based, confirm you have a static public IP. A dynamic address will break the connector the moment the ISP reassigns it.
4. Add the SPF entry for that IP on the domain, so outgoing mail is not treated as spoofed.
5. Send a test from the device to an internal address and an external one.

On the device, the settings look like this:

• Smart host: your tenant MX, in the shape contoso-com.mail.protection.outlook.com
• Port: 25
• Encryption: TLS on
• Authentication: none. The connector authenticates by certificate or IP.

A silent IP change is the usual relay outage. The ISP moves your address, the connector and SPF no longer match, and scans vanish. Check the public IP whenever relay mail stops for no obvious reason. Newcastle and Hunter offices can start from email help in Newcastle if you would rather have that connector checked than guess from the admin centre alone.

When Direct Send is enough

Direct Send looks simple. It is also the most limited. It skips authentication by sending straight to your tenant MX, which sounds convenient until you see what it cannot do.

• Device settings: MX endpoint as the server, port 25, TLS optional rather than required.
• Recipients must be inside your own Microsoft 365 tenant. Anything outside is rejected.
• No mailbox or password on the device. That is handy for a scanner that only drops PDFs into a shared accounts inbox.
• Without SPF and DKIM lined up, messages are more likely to hit a blocklist or spam folder, even for internal delivery in some setups.

Use it when the scanner only ever needs internal mailboxes. The moment someone asks "can we scan this to the client," stop. You are back to Client SMTP or a relay.

How OAuth2 app registration works

Modern authentication is where Microsoft is pushing everyone, and for a fair reason. A static mailbox password sitting in a printer menu is a weak point. OAuth2 is safer. It also adds a setup step that basic SMTP never asked for.

1. In Microsoft Entra, register an application for the scanning workflow.
2. Add the SMTP.SendAsApp permission under Office 365 Exchange Online, and grant admin consent.
3. Create a client secret. Write the expiry date somewhere you will actually see, not in a setup note nobody opens again.
4. Link the enterprise app to Exchange Online as a service principal, then grant it Send As on the scanner mailbox.
5. On the device, start the token flow. That usually means a Microsoft sign-in, and multi-factor authentication once during setup if it is on.

The device stores the token and refreshes it. The client secret behind that token still expires. When it does, scanning stops, and the error on the copier rarely says "secret expired."

Pro Tip: Set a reminder 30 days before the client secret expires, not on the day. Rotating it after scans have already failed for a week is a worse Monday than doing it early.

HP, Sharp, Kyocera, and Konica Minolta

Vendor menus use different words for the same Microsoft 365 settings. That naming mismatch trips people up more often than the actual numbers.

• HP FutureSmart walks you through an outgoing server, OAuth2 as the authentication type, then Get Token on the touchscreen. That starts a Microsoft sign-in, and MFA if it is required. HP's own support page covers that flow.
• Sharp and Kyocera use the same SMTP fields with different labels. What HP calls STARTTLS, some Kyocera menus list as SSL or TLS 1.2 required. Read the port and encryption fields. Do not assume the names line up.
• Konica Minolta supports the same three Microsoft 365 methods: Client SMTP, relay, or Direct Send, depending on firmware. Check that model's admin panel for OAuth2 before you pick a method.

If a device has no OAuth2, and firmware will not add it, do not force basic auth as a long-term workaround. Move it to connector-based SMTP relay, or a managed relay that speaks modern auth on the device's behalf.

What to check when a scan does not land

Most failures come back to a short list. Work through them in order. Guessing the next setting wastes the afternoon.

1. Run the device's built-in connection test first. It usually names the failure faster than a manual hunt.
2. Confirm port 25 or 587 is reachable from the copier's network, not only from your laptop.
3. In the Microsoft 365 admin centre, run the diagnostic against the mailbox.
4. Check Authenticated SMTP is on, the From address matches the login or has Send As, and no firewall or ISP rule is blocking outbound SMTP.
5. If mail is rejected, check SPF and DKIM against the sending IP or the connector.

Authenticated SMTP getting switched off after a tenant move is one of the most common reports. An error like 550 5.7.30 usually points to a client submission limit or an authentication mismatch, not a cable. Do not spend an hour recabling when the fix is in the mailbox.

Keep scan to email working over time

Getting it working once is the easy part. IP changes, secret expiries, and tenant updates are what break it later.

• Rotate client secrets before they expire. Calendar the rotation, not just the expiry date.
• Use a dedicated scanner mailbox so sign-in and message trace logs are not mixed with someone's inbox.
• On SMTP relay, recheck SPF whenever the public IP changes, and watch that IP's reputation.
• If DKIM and DMARC already cover the domain, make sure the scanning setup sits inside that alignment, or external spam filters start flagging it.

Pro Tip: Put "check scan-to-email client secret" on the same recurring list as SSL certificate renewals. Both fail the same way: quietly, until someone notices scans have stopped landing.

What we see on visits

The scan-to-email calls share the same roots. Authenticated SMTP was switched off after a tenant migration, and nobody noticed until invoices would not scan. A firewall or ISP change blocked port 25 or 587. A client secret expired six months after setup, and the person who configured it had left.

The first pass, before anyone books onsite: confirm Authenticated SMTP, test the port, check SPF against the current public IP, and run the Microsoft 365 diagnostic. That sequence finds the fault most of the time, before anyone touches the copier.

We start with whether the device can do OAuth2, whether scans need to leave the tenant, and whether you have a static IP. The method comes from those three facts. Not from whichever vendor PDF was open first.

PC Scientist can help with scan to email

Some of this is an admin-centre change you can do in a remote session. Some of it is a copier that needs the token flow on the glass, or a relay that needs a fixed IP onsite. That is a fair reason to stop. Email Systems Scientist can look with you, remotely first if that is enough, or onsite if the device itself is the problem.

Tell us the brand, whether scans need to go outside, and whether this used to work. We will say whether a remote session will do, or whether a visit makes more sense. Call 0493 563 381, or pick your area below.

Sources

These pages help when you want the official wording:

• How to set up a multifunction device or application to send email using Microsoft 365 or Office 365
• HP FutureSmart: set up Scan to Email with OAuth 2.0 and a Microsoft account
• Set up scan to email using Microsoft 365 (Kyocera Australia)