Microsoft 365 5.7.60: “Client does not have permissions to send as this sender”

Short answer: Your printer or app logs in to smtp.office365.com as one mailbox but sends From a different address, and that mailbox has no Send As permission for it. Fix: make the From address match the login, grant Send As, or switch the device to a relay connector.

The bounce looks like this
5.7.60 SMTP; Client does not have permissions to send as this sender
550 5.7.60 SMTP; Client does not have permissions to send as this sender

What it means

With SMTP AUTH (client submission) the device signs in to smtp.office365.com with one mailbox's username and password, and Microsoft 365 only accepts mail From that same address, or from an address the mailbox has Send As permission for. Microsoft's example: the scanner logs in as sales@contoso.com but sends as salesperson1@contoso.com. Scan-to-email profiles, print management tools, helpdesk tools and report schedulers often put the user's own address or a noreply@ address in From, which triggers this. For a device that sends as many different addresses, Microsoft says to use SMTP relay instead.

How to fix it

  1. Easiest: in the device or app, set the From (sender) address to exactly the mailbox you log in with. On printers look for Device email address, From or Sender next to the SMTP server settings; turn off options that use the logged-in user's address as From.
  2. Need a different From, such as a shared scanner@ address? Give the login mailbox Send As permission: Exchange admin center → Recipients → Mailboxes → the From mailbox → Delegation → Send as → Edit → add the login mailbox. In PowerShell: Add-RecipientPermission -Identity scanner@contoso.com -Trustee printer@contoso.com -AccessRights SendAs. Allow some time to apply.
  3. Many different From addresses (each user scans with their own address as sender)? Microsoft's answer is the relay connector: MX host, port 25, no login, any From in your accepted domains.
  4. Password (Basic) sign-in for SMTP AUTH is switched off by default at the end of December 2026 (535 5.7.139), so if you're touching this device anyway, move it to OAuth or relay now.
  5. Then send a test to an outside address and check SPF, DKIM and DMARC for the From domain below.

Step-by-step for your device or app

Not sure which devices still log in with a password? Run the free read-only script that lists every SMTP AUTH sender in your tenant.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)

Rather have it done for you? I move your devices and apps on Fiverr – relay, Direct Send or OAuth, tested, from $25.

Check your domain now

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 28-page guide, checklist, 20+ providers.

Did this fix it?

What's still not working?

Paste the bounce message or describe what happens. We read every report and add fixes for new errors.

Other bounce errors