# Scan to Email with Microsoft 365: Printer SMTP Options That Still Work

> Fix scan to email on a printer or scanner using Microsoft 365: compare SMTP client submission, SMTP relay connector, Direct Send and High Volume Email, with settings for each.

Source: https://www.epifive.com/blog/scan-to-email-microsoft-365-smtp-options · Published 2026-10-25 · EpiFive

## Key takeaways

- Microsoft 365 offers four routes for scan to email, which are SMTP client submission, SMTP relay with a connector, Direct Send and High Volume Email.
- High Volume Email delivers to internal recipients only, uses port 587 and costs US$42 per million delivered recipients through pay-as-you-go billing.
- SMTP relay needs a static public IP address or a certificate, uses port 25, and can send to external recipients without a licensed mailbox.
- Client SMTP submission with Basic authentication is scheduled for retirement, so check Microsoft's current timeline before building a new setup on it.
- Direct Send reaches only your own Microsoft 365 mailboxes and is treated as anonymous mail from the internet, so SPF, DKIM and DMARC must be right.

A printer or scanner can send scan-to-email through Microsoft 365 in four ways: client SMTP submission (a mailbox sign-in on `smtp.office365.com`, port 587), an SMTP relay connector (port 25 to your MX endpoint, authenticated by static IP address or certificate), Direct Send (anonymous, internal recipients only) or High Volume Email (a dedicated account, internal recipients only). Which works best depends on whether the scanner must reach external addresses, whether it supports modern TLS, and whether your office has a static public IP address.

This guide is for administrators who have a multifunction device that stopped sending, or who are setting one up now. At the end you will have chosen a method, configured the Microsoft 365 side, entered the device settings and tested delivery.

## Why scan to email breaks

Scanners create email but are not mail servers, so they need help to send it. The usual reasons for a failure are:

- The device used Basic authentication against `smtp.office365.com`. Microsoft has announced plans to retire Basic authentication for SMTP AUTH client submission, and the timeline has been updated; check the current announcement linked from Microsoft's deprecation page before relying on it.
- SMTP AUTH is disabled on the tenant or mailbox. It is disabled for organisations created after January 2020, and it is already disabled if Microsoft Entra security defaults are on.
- The device only supports TLS older than 1.2, or defaults to port 465.
- The device sends from an address that the signed-in mailbox cannot send as.
- Port 25 is blocked by the network or the internet provider.

## Compare the four methods

| | Client SMTP submission | SMTP relay | Direct Send | High Volume Email |
| --- | --- | --- | --- | --- |
| Server | `smtp.office365.com` | Your MX endpoint, for example `contoso-com.mail.protection.outlook.com` | Your MX endpoint | `smtp.hve.mx.microsoft` |
| Port | 587 (recommended) or 25 | 25 | 25 | 587 |
| TLS | Required (1.2 or 1.3) | Optional per Microsoft's table, though TLS is recommended | Optional | Required |
| Authentication | Mailbox username and password | Static IP address or certificate | None | HVE account credentials or OAuth token |
| External recipients | Yes | Yes | No | No |
| Licensed mailbox needed | Yes | No | No | No |
| Limits | 10,000 recipients per day, 30 messages per minute | Reasonable limits, not for bulk mail | Standard anonymous throttling | No rate limits; 50 recipients per message, 10 MB messages |

Microsoft's own advice for devices that send only to internal recipients is High Volume Email. For devices that must reach both internal and external recipients, Microsoft points to Azure Communication Services Email, or to your own on-premises mail server if you have one. SMTP relay remains documented for cases where those do not work, and it is also the choice when a device needs higher limits than a mailbox allows.

## Option 1: High Volume Email for internal-only scanning

If staff scan to their own addresses, High Volume Email (HVE) is the cleanest fit.

### What to know first

- HVE accounts have no mailbox and cannot receive mail. If recipients may reply, set a Reply-To address on the account.
- Up to 100 HVE accounts per tenant, up to 50 recipients per message and 10 MB per message.
- HVE uses Microsoft 365 pay-as-you-go billing. Microsoft lists the price as US$0.000042 per expanded delivered recipient, which is US$42 per million recipients. Each HVE account needs a billing policy linked to an Azure subscription before it can send.
- You do not need to licence the HVE account.
- Security defaults disable Basic authentication, in which case HVE can authenticate only with OAuth. Most printers cannot do OAuth, so a printer using username and password needs security defaults off.

### Create the account

1. Open the Exchange admin center at https://admin.exchange.microsoft.com/.
2. Go to **Mail flow** > **High Volume Email** and select **Add an HVE account**.
3. Enter a display name, a primary email address in an accepted domain (for example `scanner@contoso.com`) and a password.
4. On the pay-as-you-go step, pick a billing policy, or assign one later.

Or use PowerShell:

```powershell
$securePassword = Read-Host "Enter password" -AsSecureString
New-MailUser -HVEAccount -Name "Scanner HVE" -Password $securePassword -PrimarySmtpAddress "scanner@contoso.com"
```

### Printer settings

| Setting | Value |
| --- | --- |
| SMTP server | `smtp.hve.mx.microsoft` (Microsoft says `smtp-hve.office365.com` will be deprecated) |
| Port | 587 |
| TLS / STARTTLS | Enabled |
| Username and password | The HVE account |
| From address | The HVE address |

HVE accounts can authenticate even when SMTP AUTH is disabled in the tenant, because HVE uses its own endpoint.

## Option 2: SMTP relay connector for external recipients

Use this when the device must email people outside your organisation and cannot use a mailbox sign-in.

### Requirements

- Port 25 open outbound from your network.
- Either a certificate whose Subject or SAN contains an accepted domain, or a static public IP address that is not shared with another organisation. Dynamic IP addresses are not supported.
- An inbound connector in Exchange Online.
- An SPF record that includes the source IP address.

SMTP relay cannot be used to send from a third-party hosted service such as a virtual machine in Azure.

### Create the connector (IP address-based)

1. In the Exchange admin center at https://admin.cloud.microsoft/exchange#/, go to **Mail flow** > **Connectors** and select **Add a connector**.
2. Set **Connection from** to **Your organization's email server**. **Connection to** is Office 365 automatically.
3. Name the connector, leave **Turn it on** selected, and leave **Retain internal Exchange email headers** unselected.
4. On **Authenticating sent email**, choose **By verifying that the IP address of the sending server matches one of the following IP addresses which belong exclusively to your organization** and enter the public IP address of the office.
5. Review and select **Create connector**.

Add the IP address to your domain's SPF record. For a certificate-based connector, pick the subject name option instead and enter the accepted domain from the certificate; Microsoft suggests `*.contoso.com` if the certificate lists several hosts.

### Find your MX endpoint

In the Microsoft 365 admin center, go to **Settings** > **Domains**, select the domain, open the **DNS records** tab and copy the **Points to address or value** of the MX record. It has the form `contoso-com.mail.protection.outlook.com`.

### Printer settings

| Setting | Value |
| --- | --- |
| SMTP server | Your MX endpoint |
| Port | 25 |
| TLS | Enabled (TLS 1.2 or 1.3) |
| Authentication | None; the connector trusts the source IP or certificate |
| From address | Any address in an accepted domain, for example `scanner@contoso.com`; it does not need a mailbox |

## Option 3: Client SMTP submission

If you already use this method, it works only while your device and tenant still allow it. Settings: server `smtp.office365.com`, port 587, TLS or STARTTLS enabled (1.2 or 1.3), and the sign-in of a licensed mailbox.

Enable SMTP AUTH for just that mailbox:

```powershell
Set-CASMailbox -Identity scanner@contoso.com -SmtpClientAuthenticationDisabled $false
```

Verify it:

```powershell
Get-CASMailbox -Identity scanner@contoso.com | Format-List SmtpClientAuthenticationDisabled
```

`False` means enabled, `True` means disabled, and blank means the organisation setting applies. The per-mailbox value overrides the organisation value. In the Microsoft 365 admin center the same switch is **Users** > **Active users** > the user > **Mail** > **Manage email apps** > **Authenticated SMTP**.

If the organisation setting turns SMTP AUTH off, the tenant-wide command is `Set-TransportConfig -SmtpClientAuthenticationDisabled $true` (use `$false` to turn it back on). Keep it disabled org-wide and enable it only for the one mailbox that needs it.

Because Basic authentication for this method is scheduled to be retired, do not build a new setup on it. See [SMTP AUTH vs Direct Send vs relay](https://www.epifive.com/blog/smtp-auth-vs-direct-send-vs-relay) and [SMTP AUTH with OAuth client credentials](https://www.epifive.com/blog/smtp-auth-oauth-client-credentials-setup).

## Option 4: Direct Send

Microsoft says most customers do not need Direct Send. The device sends mail to your MX endpoint on port 25 with no authentication, and it can deliver only to mailboxes in your own Microsoft 365 organisation. Mail to external recipients is rejected. It is treated like anonymous internet mail, so all scanning applies and you must set up SPF, DKIM and DMARC correctly. Microsoft is working on an option to disable Direct Send by default. If you plan to tighten that, read [Reject Direct Send in Exchange Online](https://www.epifive.com/blog/reject-direct-send-exchange-online) first, because a device relying on Direct Send will stop working.

## Test and troubleshoot

1. Send a scan to your own address and confirm it arrives.
2. If it does not, use message trace in the Exchange admin center to see whether Exchange received it. See [message trace with Get-MessageTraceV2](https://www.epifive.com/blog/message-trace-exchange-online-get-messagetracev2).

| Symptom | Likely cause | Fix |
| --- | --- | --- |
| `5.7.60 SMTP; Client doesn't have permissions to send as this sender` | The signed-in mailbox sends as another address | Send from the mailbox address or grant Send As permission |
| Authentication fails on `smtp.office365.com` | SMTP AUTH disabled, security defaults on, or Basic authentication blocked | Enable SMTP AUTH on the mailbox, or move to HVE or SMTP relay |
| Device won't connect on 465 | Port 465 is not supported for client submission | Use 587 with STARTTLS |
| Connection times out on 25 | Port blocked by firewall or provider | Open port 25 or use port 587 methods |
| Mail lands in Junk | SPF missing the source IP, or anonymous mail filtered | Update SPF; add DKIM and DMARC |
| Device cannot do TLS 1.2 | Old firmware | Update the firmware or use an on-premises relay server |

## Closing checklist

- Decide whether the scanner needs external recipients.
- Internal only: High Volume Email with a billing policy. External: SMTP relay with a static IP address or certificate.
- Allow outbound port 587 or 25 as the method requires.
- Add the source IP address to SPF for relay and Direct Send.
- Test, then check message trace if mail is missing.

## References

- How to set up a multifunction device or application to send email using Microsoft 365: https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365
- Manage High Volume Email for Microsoft 365: https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/high-volume-mails-m365
- Enable or disable SMTP AUTH in Exchange Online: https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission
- Deprecation of Basic authentication in Exchange Online: https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online

## Frequently asked questions

### What SMTP server and port should a printer use for Microsoft 365?

It depends on the method. Client SMTP submission uses smtp.office365.com on port 587 with TLS 1.2 or later. SMTP relay and Direct Send use your domain's MX endpoint, such as contoso-com.mail.protection.outlook.com, on port 25. High Volume Email uses smtp.hve.mx.microsoft on port 587.

### Why does scan to email fail on port 465?

Microsoft states that if a device or application defaults to TCP port 465, it does not support the TLS versions required for client SMTP submission. Use port 587 with STARTTLS, or switch to a method such as SMTP relay that the device can support.

### Can a scanner send to external addresses with High Volume Email?

No. High Volume Email delivers to internal recipients in your tenant only. If the scanner must email customers or suppliers, Microsoft suggests Azure Communication Services Email, an SMTP relay connector with a static IP address or certificate, or your own mail server.

### What does the error 5.7.60 mean when a scanner sends mail?

The full text is SMTP; Client doesn't have permissions to send as this sender. The mailbox used to sign in is sending as a different address and lacks Send As permission. Either send as the signed-in mailbox address or grant Send As on the sender mailbox.