Scan to email for Microsoft 365 offices and MSPs
A hosted relay for Microsoft 365. Scans go out through your own Microsoft 365, not a third-party mail service, so Sent Items, retention and audit keep working. No server, static IP or firmware update.
550 5.7.30 Basic authentication is not supported for Client Submission
If your copier shows this, or soon will, you’re in the right place.
From January
Rejected: password sign-in no longer accepted
With ScanFerry
01
Sept 2025
First announced cutoff. Postponed.
Mar–Apr 2026
Second cutoff. Postponed again.
End of Dec 2026
Off by default for existing tenants. Admins can switch it back on, for now.
Jan 2027
Tenants created from here on can’t use it at all.
2nd half of 2027
Microsoft announces the date it’s removed for good.
Switching it back on buys time. It doesn’t fix anything, and it keeps a password-only way into your tenant open until Microsoft closes it for you.
Source: Microsoft 365 Message Center, MC786329 (revised 27 January 2026).
02
Anything that sends email through Microsoft 365 with a plain username and password typed into its settings. When basic auth is off, it stops sending, usually without telling anyone.
The proper fix is modern sign-in (OAuth) on the device itself. Some newer copiers have it. Many older ones will never get the firmware, and most apps and alarm panels weren’t built for it.
| Time | To | Result |
|---|---|---|
| 08:41 | amy@yourfirm.com | Failed 5.7.30 |
| 08:52 | orders@supplier.com | Failed 5.7.30 |
| 09:03 | billing@client.com | Failed 5.7.30 |
| 09:17 | jen@yourfirm.com | Failed 5.7.30 |
03
| Option | No server or static IP | Outside recipients | Stays in your Microsoft 365 | No DNS changes |
|---|---|---|---|---|
| Copier firmware with modern sign-inIf your model supports it, do this. Some models make you sign in again every 90 days. | Yes | Yes | Yes | Yes |
| Switch basic auth back onExchange admin centerWorks until Microsoft removes it for good. | Yes | Yes | Yes | Yes |
| Microsoft High Volume EmailInternal recipients only. Now billed pay-as-you-go. | Yes | Nointernal only | Yes | Yes |
| Azure Communication Services EmailClosed to new customers from 23 Oct 2026. Retiring Sept 2028. | Yes | Yes | Noexternal | Nodomain setup |
| Exchange connector relayNeeds a fixed public IP at the office. | Nostatic IP | Yes | Yes | NoSPF |
| SMTP relay servicesSMTP2GO, SendGrid, MailgunScans leave through their servers: no Sent Items, outside your Microsoft retention and audit. | Yes | Yes | Nothird party | NoSPF, DKIM |
| Self-hosted SMTP-to-Graph bridgePostfix, SMTP2Graph and other open-source toolsNeeds a VM, someone comfortable in Entra, and upkeep. | Noa VM | Yes | Yes | Yes |
| ScanFerryHosted for you. Set up in about 10 minutes. | Yes | Yes | Yes | Yes |
| Option | No server or static IP | Outside recipients | Stays in your Microsoft 365 | No DNS changes |
|---|---|---|---|---|
| Copier firmware with modern sign-inIf your model supports it, do this. Some models make you sign in again every 90 days. | Yes | Yes | Yes | Yes |
| Switch basic auth back onExchange admin centerWorks until Microsoft removes it for good. | Yes | Yes | Yes | Yes |
| Microsoft High Volume Emailinternal only | Yes | No | Yes | Yes |
| Azure Communication Services Emailexternal · domain setup | Yes | Yes | No | No |
| Exchange connector relaystatic IP · SPF | No | Yes | Yes | No |
| SMTP relay servicesSMTP2GO, SendGrid, Mailgunthird party · SPF, DKIM | Yes | Yes | No | No |
| Self-hosted SMTP-to-Graph bridgePostfix, SMTP2Graph and other open-source toolsa VM | No | Yes | Yes | Yes |
| ScanFerryHosted for you. Set up in about 10 minutes. | Yes | Yes | Yes | Yes |
When Microsoft changes the rules again, your copiers don’t change.
In two years the cutoff moved three times, High Volume Email became paid, and Azure Communication Services Email was scheduled for retirement. ScanFerry sits between your devices and Microsoft. When Microsoft changes something, we update ScanFerry, and every copier keeps the same settings.
04
An admin approves ScanFerry once and picks the mailboxes it may send as, for example scans@. Nothing else.
Mail.Send, limited to chosen mailboxes
Change the server and login on the copier. Every device gets its own short password that older copiers accept, and nothing on the device ever needs renewing.
smtp.scanferry.com · 587 · STARTTLS
Mail goes out from your own mailbox, shows up in Sent Items, and every send is logged where you can see it.
Delivered through Microsoft Graph
| Time | Device | From | To | Status |
|---|---|---|---|---|
| 08:41 | Front desk MFP | scans@yourfirm.com | amy@yourfirm.com | Sent |
| 08:52 | Front desk MFP | scans@yourfirm.com | orders@supplier.com | Sent |
| 09:03 | Accounts app | invoices@yourfirm.com | billing@client.com | Sent |
| 09:17 | Back office NAS | alerts@yourfirm.com | it@yourfirm.com | Sent |
Every message also lands in the sending mailbox’s Sent Items.
05
Priced per Microsoft 365 tenant, which means one company’s Microsoft 365, usually one email domain. Any number of mailboxes and users inside it.
For one company’s Microsoft 365.
$29/month
For IT providers looking after several clients.
$99/month
Early access. Nothing is charged today. At launch: billed monthly, cancel anytime, full refund within 14 days.
06
You’re giving a service permission to send mail as your company. Here is exactly what that permission covers, and what it never does.
Mail.Send only, limited to the mailboxes you pick with Exchange’s RBAC for Applications. No read access.
Every device signs in with its own credentials. Optional office IP lock, plus per-device and per-tenant limits.
TLS 1.2 or later from the device to ScanFerry by default, and HTTPS from ScanFerry to Microsoft Graph.
Messages are relayed and discarded. Only the log entry is kept: time, device, sender, recipient, result.
Every send is logged. If a device stops sending or Microsoft rejects a message, you get an email that day, not a complaint a week later.
Remove ScanFerry in Entra and sending stops straight away. No agent or software left behind.
07
Scan-to-email breaks quietly, usually on the morning someone needs it. Reserve a spot and be set up before then.