Canon, Xerox, and Lexmark Scan to Email After the December 2026 Microsoft Change
November 11th, 2026
6 min read
At the end of December 2026, Microsoft disables Basic Authentication for SMTP AUTH by default on existing Microsoft 365 tenants. Any copier that scans to email using a saved username and password will stop sending once that happens. The fix is one of three paths: move the device to OAuth 2.0 if the model supports it, route the device through an SMTP relay, or send through a mail service outside Microsoft 365. Which path fits depends on the make, the model generation, and the firmware already on the machine.
This guide covers the corrected timeline, what actually breaks, and where Canon, Xerox, and Lexmark devices stand.
Key takeaways
- The deadline is the end of December 2026. Earlier dates of March 2026 and April 2026 were revised by Microsoft and are no longer accurate.
- Administrators can still re-enable Basic Authentication after the December change. It is disabled by default, not removed.
- Only Basic Authentication is affected. SMTP AUTH submission using OAuth continues to work.
- Scan to folder, scan to USB, and ordinary printing are not affected by this change.
- OAuth support is model and firmware dependent on every brand. An SMTP relay is the universal fallback for devices that cannot do OAuth.
What exactly changes at the end of December 2026?
Microsoft's Exchange Team published a revised timeline on January 27, 2026. The current milestones are:
- Through December 2026, SMTP AUTH Basic Authentication behavior remains unchanged.
- At the end of December 2026, Basic Authentication for SMTP AUTH is disabled by default on existing tenants. Administrators retain the ability to enable it.
- Tenants created after December 2026 do not have Basic Authentication for SMTP AUTH available by default, and OAuth becomes the supported method.
- In the second half of 2027, Microsoft will announce the final removal date.
That last point matters for planning. Disable-by-default is not the end of the road. A permanent removal date is coming, and it has not been set yet, so treat any configuration that depends on Basic Authentication as temporary rather than solved.
If you have read that this deadline falls in March or April of 2026, that information predates the revision. The original announcement set a staged rejection beginning March 1, 2026, reaching full rejection in April. Microsoft replaced that schedule in January. A fair amount of published guidance still carries the old dates, which is worth knowing if you are comparing sources.
One more clarification that causes confusion: SMTP AUTH itself is not going away. Microsoft is retiring the use of Basic Authentication within SMTP AUTH. Devices submitting through SMTP AUTH with modern authentication are unaffected.
What breaks, and what keeps working?
The functions at risk are the ones that send mail from the device through your Microsoft 365 tenant using stored credentials:
- Scan to email
- Internet fax and fax forwarding to email
- Automated device notifications such as meter reads, supply alerts, and error messages
These functions are not affected, because they do not use SMTP:
- Printing
- Scan to folder and scan to network share
- Scan to USB
The failure mode is worth describing, because it is how most offices will find out. Nothing changes on the copier. The device configuration is still correct. Jobs simply begin failing with an authentication error, and the usual first assumption is that the machine broke.
What are the three options for fixing it?
| Option | How it works | Best when | Watch out for |
|---|---|---|---|
| OAuth 2.0 on the device | The device authenticates with a token instead of a stored password. Requires registering the device in Microsoft Entra and completing an authorization flow at the panel. | The model and firmware support it, and you want the most secure path. | Setup requires Entra and token knowledge. Tokens expire and can require re-authorization. |
| SMTP relay | A connector in Microsoft 365 authenticates the device by IP address rather than credentials. The device sends to the relay and Microsoft handles delivery. | Devices cannot do OAuth, or you want one configuration across a mixed fleet. | Requires a static IP. Mail can be disrupted if your address reputation suffers. |
| Mail service outside Microsoft 365 | A third-party SMTP provider handles device mail, often with its own credentials or an API key. | The fleet is old, mixed, or you want device mail off the production tenant entirely. | Adds a vendor and a cost. Deliverability becomes that provider's responsibility. |
Microsoft also offers High Volume Email for Microsoft 365, which is built for internal-only sending at volume. It is worth knowing about, but it is a narrower fit than the three options above for a typical office copier.
Where do Canon, Xerox, and Lexmark stand?
The honest answer for all three brands is that OAuth support depends on the model generation and the firmware on the machine, not on the badge. There is no brand where every device is covered and none where every device is stranded. The table below reflects what we see across the fleets we service.
| Brand | General position | Likely to support OAuth | Likely to need a relay |
|---|---|---|---|
| Canon | Current imageRUNNER ADVANCE DX devices expose an OAuth 2.0 setting for Microsoft in the send configuration. Canon publishes setup documentation for it. | Recent imageRUNNER ADVANCE and ADVANCE DX models on current firmware | First-generation imageRUNNER ADVANCE devices and the small-office imageCLASS line, which has not offered Microsoft OAuth support |
| Xerox | Support is the least uniform of the three and has shifted over several firmware cycles. Verify the specific model rather than assuming by family. | Current AltaLink and VersaLink devices on recent firmware | Older WorkCentre devices and any model where the panel offers only a password field for SMTP |
| Lexmark | Lexmark publishes a knowledge base article covering OAuth 2 setup, and support is reasonably well documented on current firmware. | Current devices updated to recent firmware | Older devices past their firmware support window |
Two practical notes that apply regardless of brand. First, firmware is the variable that decides most of these cases, and a device that cannot do OAuth today may be able to after an update. Second, a device with no firmware path to OAuth is not necessarily a device you need to replace. A relay keeps it working.
What goes wrong after the switch?
OAuth solves the authentication problem and introduces a maintenance one, which is the part most guidance leaves out.
Tokens expire. Refresh handling varies by device, and a machine that authenticated correctly in December can stop sending weeks later when a token cannot be renewed. We also see devices lose their authorization after a power loss or an internet outage, returning a token error that requires an administrator to re-authorize at the panel or through the remote interface.
None of this makes OAuth the wrong choice. It does mean that configuring the device is not the end of the project, and that somebody needs to own the re-authorization when it happens. On a fleet of any size, that ownership question is worth settling before the deadline rather than during a Monday morning outage.
What should you do in the next 30 days?
The work splits cleanly between your IT administrator and whoever services your devices.
On the Microsoft side. Open the SMTP AUTH Clients Submission Report in the Exchange admin center. It shows which accounts are submitting mail and whether they are using Basic Authentication or OAuth. That report is the fastest way to learn whether you are exposed at all, and it frequently surfaces devices nobody remembered were sending mail.
On the device side. Inventory every machine that sends mail, including the ones sending only notifications. For each, record the model, the current firmware, and the authentication method configured. That list determines which devices move to OAuth and which need a relay.
Then decide the path per device and test before the end of December. Testing in January, after submissions start failing, means troubleshooting a live outage instead of a planned change.
How EDGE helps
We service Canon, Xerox, and Lexmark as an independent dealer, which means we work through this change across all three fleets rather than one manufacturer's installed base. For clients under a managed agreement, the device inventory already exists, so the question of which machines are exposed is one we can answer without a discovery project.
For organizations that are not EDGE clients, the device-side work is still straightforward to scope. The inventory and the firmware check tell you most of what you need, and the remaining decisions follow from there.
If you would rather not work through it alone, schedule a 10-minute call and we will walk your fleet with you. For background on the change itself, our earlier article on the Microsoft 365 scan to email change covers the policy side in more depth, and our guide to choosing a copier brand is useful if this change has you evaluating a fleet refresh.
Frequently asked questions
When exactly does Microsoft disable Basic Authentication for scan to email?
At the end of December 2026 for existing Microsoft 365 tenants, where it becomes disabled by default. Administrators can still re-enable it after that date. Tenants created after December 2026 will not have it available by default. Microsoft will announce a final removal date in the second half of 2027. Earlier published dates of March 1, 2026 and April 2026 were revised in January 2026 and no longer apply.
Will my copier stop printing?
No. This change affects only functions that send email through Microsoft 365 using stored credentials. Printing, scan to folder, and scan to USB continue to work normally.
Do Canon, Xerox, and Lexmark copiers support OAuth 2.0?
Support depends on the model generation and the installed firmware rather than the brand. Current Canon imageRUNNER ADVANCE DX, Xerox AltaLink and VersaLink, and recent Lexmark devices on current firmware are the strongest candidates. Older devices and small-office models frequently have no OAuth path and need an SMTP relay instead.
What happens if my copier cannot support OAuth?
Route it through an SMTP relay. A connector in Microsoft 365 authenticates the device by IP address rather than by username and password, which keeps scan to email working on devices that cannot authenticate with a token. Replacing the machine is rarely necessary for this reason alone.
Why did my scan to email stop working when nothing changed on the copier?
Because the change happened on the Microsoft side rather than on the device. The copier configuration remains exactly as it was, but Microsoft 365 stops accepting the credentials it sends, and jobs fail with an authentication error.
Is SMTP AUTH being removed entirely?
No. Microsoft is retiring the use of Basic Authentication within SMTP AUTH. Submission through SMTP AUTH using OAuth continues to be supported.