A printer or scanner can send scan-to-email through Microsoft 365 in four ways: client SMTP submission (a mailbox sign-in on smtp.office365.com, port 587), an SMTP relay connector (port 25 to your MX endpoint, authenticated by static IP address or certificate), Direct Send (anonymous, internal recipients only) or High Volume Email (a dedicated account, internal recipients only). Which works best depends on whether the scanner must reach external addresses, whether it supports modern TLS, and whether your office has a static public IP address.
This guide is for administrators who have a multifunction device that stopped sending, or who are setting one up now. At the end you will have chosen a method, configured the Microsoft 365 side, entered the device settings and tested delivery.
Why scan to email breaks
Scanners create email but are not mail servers, so they need help to send it. The usual reasons for a failure are:
- The device used Basic authentication against
smtp.office365.com. Microsoft has announced plans to retire Basic authentication for SMTP AUTH client submission, and the timeline has been updated; check the current announcement linked from Microsoft's deprecation page before relying on it. - SMTP AUTH is disabled on the tenant or mailbox. It is disabled for organisations created after January 2020, and it is already disabled if Microsoft Entra security defaults are on.
- The device only supports TLS older than 1.2, or defaults to port 465.
- The device sends from an address that the signed-in mailbox cannot send as.
- Port 25 is blocked by the network or the internet provider.
Compare the four methods
| Client SMTP submission | SMTP relay | Direct Send | High Volume Email | |
|---|---|---|---|---|
| Server | smtp.office365.com | Your MX endpoint, for example contoso-com.mail.protection.outlook.com | Your MX endpoint | smtp.hve.mx.microsoft |
| Port | 587 (recommended) or 25 | 25 | 25 | 587 |
| TLS | Required (1.2 or 1.3) | Optional per Microsoft's table, though TLS is recommended | Optional | Required |
| Authentication | Mailbox username and password | Static IP address or certificate | None | HVE account credentials or OAuth token |
| External recipients | Yes | Yes | No | No |
| Licensed mailbox needed | Yes | No | No | No |
| Limits | 10,000 recipients per day, 30 messages per minute | Reasonable limits, not for bulk mail | Standard anonymous throttling | No rate limits; 50 recipients per message, 10 MB messages |
Microsoft's own advice for devices that send only to internal recipients is High Volume Email. For devices that must reach both internal and external recipients, Microsoft points to Azure Communication Services Email, or to your own on-premises mail server if you have one. SMTP relay remains documented for cases where those do not work, and it is also the choice when a device needs higher limits than a mailbox allows.
Option 1: High Volume Email for internal-only scanning
If staff scan to their own addresses, High Volume Email (HVE) is the cleanest fit.
What to know first
- HVE accounts have no mailbox and cannot receive mail. If recipients may reply, set a Reply-To address on the account.
- Up to 100 HVE accounts per tenant, up to 50 recipients per message and 10 MB per message.
- HVE uses Microsoft 365 pay-as-you-go billing. Microsoft lists the price as US$0.000042 per expanded delivered recipient, which is US$42 per million recipients. Each HVE account needs a billing policy linked to an Azure subscription before it can send.
- You do not need to licence the HVE account.
- Security defaults disable Basic authentication, in which case HVE can authenticate only with OAuth. Most printers cannot do OAuth, so a printer using username and password needs security defaults off.
Create the account
- Open the Exchange admin center at https://admin.exchange.microsoft.com/.
- Go to Mail flow > High Volume Email and select Add an HVE account.
- Enter a display name, a primary email address in an accepted domain (for example
[email protected]) and a password. - On the pay-as-you-go step, pick a billing policy, or assign one later.
Or use PowerShell:
$securePassword = Read-Host "Enter password" -AsSecureString
New-MailUser -HVEAccount -Name "Scanner HVE" -Password $securePassword -PrimarySmtpAddress "[email protected]"Printer settings
| Setting | Value |
|---|---|
| SMTP server | smtp.hve.mx.microsoft (Microsoft says smtp-hve.office365.com will be deprecated) |
| Port | 587 |
| TLS / STARTTLS | Enabled |
| Username and password | The HVE account |
| From address | The HVE address |
HVE accounts can authenticate even when SMTP AUTH is disabled in the tenant, because HVE uses its own endpoint.
Option 2: SMTP relay connector for external recipients
Use this when the device must email people outside your organisation and cannot use a mailbox sign-in.
Requirements
- Port 25 open outbound from your network.
- Either a certificate whose Subject or SAN contains an accepted domain, or a static public IP address that is not shared with another organisation. Dynamic IP addresses are not supported.
- An inbound connector in Exchange Online.
- An SPF record that includes the source IP address.
SMTP relay cannot be used to send from a third-party hosted service such as a virtual machine in Azure.
Create the connector (IP address-based)
- In the Exchange admin center at https://admin.cloud.microsoft/exchange#/, go to Mail flow > Connectors and select Add a connector.
- Set Connection from to Your organization's email server. Connection to is Office 365 automatically.
- Name the connector, leave Turn it on selected, and leave Retain internal Exchange email headers unselected.
- On Authenticating sent email, choose By verifying that the IP address of the sending server matches one of the following IP addresses which belong exclusively to your organization and enter the public IP address of the office.
- Review and select Create connector.
Add the IP address to your domain's SPF record. For a certificate-based connector, pick the subject name option instead and enter the accepted domain from the certificate; Microsoft suggests *.contoso.com if the certificate lists several hosts.
Find your MX endpoint
In the Microsoft 365 admin center, go to Settings > Domains, select the domain, open the DNS records tab and copy the Points to address or value of the MX record. It has the form contoso-com.mail.protection.outlook.com.
Printer settings
| Setting | Value |
|---|---|
| SMTP server | Your MX endpoint |
| Port | 25 |
| TLS | Enabled (TLS 1.2 or 1.3) |
| Authentication | None; the connector trusts the source IP or certificate |
| From address | Any address in an accepted domain, for example [email protected]; it does not need a mailbox |
Option 3: Client SMTP submission
If you already use this method, it works only while your device and tenant still allow it. Settings: server smtp.office365.com, port 587, TLS or STARTTLS enabled (1.2 or 1.3), and the sign-in of a licensed mailbox.
Enable SMTP AUTH for just that mailbox:
Set-CASMailbox -Identity [email protected] -SmtpClientAuthenticationDisabled $falseVerify it:
Get-CASMailbox -Identity [email protected] | Format-List SmtpClientAuthenticationDisabledFalse means enabled, True means disabled, and blank means the organisation setting applies. The per-mailbox value overrides the organisation value. In the Microsoft 365 admin center the same switch is Users > Active users > the user > Mail > Manage email apps > Authenticated SMTP.
If the organisation setting turns SMTP AUTH off, the tenant-wide command is Set-TransportConfig -SmtpClientAuthenticationDisabled $true (use $false to turn it back on). Keep it disabled org-wide and enable it only for the one mailbox that needs it.
Because Basic authentication for this method is scheduled to be retired, do not build a new setup on it. See SMTP AUTH vs Direct Send vs relay and SMTP AUTH with OAuth client credentials.
Option 4: Direct Send
Microsoft says most customers do not need Direct Send. The device sends mail to your MX endpoint on port 25 with no authentication, and it can deliver only to mailboxes in your own Microsoft 365 organisation. Mail to external recipients is rejected. It is treated like anonymous internet mail, so all scanning applies and you must set up SPF, DKIM and DMARC correctly. Microsoft is working on an option to disable Direct Send by default. If you plan to tighten that, read Reject Direct Send in Exchange Online first, because a device relying on Direct Send will stop working.
Test and troubleshoot
- Send a scan to your own address and confirm it arrives.
- If it does not, use message trace in the Exchange admin center to see whether Exchange received it. See message trace with Get-MessageTraceV2.
| Symptom | Likely cause | Fix |
|---|---|---|
5.7.60 SMTP; Client doesn't have permissions to send as this sender | The signed-in mailbox sends as another address | Send from the mailbox address or grant Send As permission |
Authentication fails on smtp.office365.com | SMTP AUTH disabled, security defaults on, or Basic authentication blocked | Enable SMTP AUTH on the mailbox, or move to HVE or SMTP relay |
| Device won't connect on 465 | Port 465 is not supported for client submission | Use 587 with STARTTLS |
| Connection times out on 25 | Port blocked by firewall or provider | Open port 25 or use port 587 methods |
| Mail lands in Junk | SPF missing the source IP, or anonymous mail filtered | Update SPF; add DKIM and DMARC |
| Device cannot do TLS 1.2 | Old firmware | Update the firmware or use an on-premises relay server |
Closing checklist
- Decide whether the scanner needs external recipients.
- Internal only: High Volume Email with a billing policy. External: SMTP relay with a static IP address or certificate.
- Allow outbound port 587 or 25 as the method requires.
- Add the source IP address to SPF for relay and Direct Send.
- Test, then check message trace if mail is missing.
References
- How to set up a multifunction device or application to send email using Microsoft 365: https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365
- Manage High Volume Email for Microsoft 365: https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/high-volume-mails-m365
- Enable or disable SMTP AUTH in Exchange Online: https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission
- Deprecation of Basic authentication in Exchange Online: https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online
Comments
Questions and tips are welcome. Comments are checked by the EpiFive team before they appear; please do not share passwords, phone numbers or other private details.