Brother printers, MFCs and scanners: email through Microsoft 365 after Basic auth ends

Short answer: Many Brother MFC, DCP, HL and ADS models support OAuth 2.0 for Exchange Online, some only after a firmware update: check Brother's support list. Set it in Web Based Management → Network → Protocol → POP3/IMAP4/SMTP Client → Third party (OAuth2) → Outlook. Unlisted models need a relay connector.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

Brother's OAuth 2.0 Authentication Support Statement has a Product Support List. Models marked ※1 already support OAuth 2.0 and only need configuring (for example MFC-L2800DW, MFC-L2960DW, DCP-L2620DW, HL-L2865DW, MFC-L8730CDW, MFC-EX570 and MFC-J3660DW). Models marked ※2 need a firmware update first (for example MFC-L2710DW, DCP-L2530DW, HL-L3210CW, MFC-L6970DW and the ADS document scanners). Brother says models not on the list don't support OAuth 2.0. Path: Web Based Management (https://printer-IP/) → Network → Network → Protocol → Advanced Settings next to POP3/IMAP4/SMTP Client → Third party (OAuth2) → Outlook.

What you will see when it breaks

Authentication Error (Brother FAQ: Microsoft Exchange Online without OAuth 2.0)
Receiving Error (same Brother FAQ)
535 5.7.139 Authentication unsuccessful, basic authentication is disabled. (Microsoft's reply; reported in Microsoft Q&A)
Reported: Scan to E-mail Server stops while the same mailbox still works in Outlook (Microsoft Q&A)

Best fix

Find your model on Brother's Product Support List. If it is marked ※2, install the latest firmware first.
Keep Authenticated SMTP on for the scanner mailbox in Microsoft 365.
Open Web Based Management at https://printer-IP/ and log in (the default password is on the label marked "Pwd"). Go to Network → Network → Protocol and click Advanced Settings next to POP3/IMAP4/SMTP Client.
Click Third party (OAuth2) → Outlook, enter the scanner mailbox address, pick the functions and protocol, and click OK.
Note the code, click Sign in, enter it at Microsoft and finish the sign-in. Close that tab without clicking Sign in again, then click OK and Submit.
Send a test scan to an outside address.

If it can't do OAuth

Brother's own advice for unlisted models is another email service, such as Gmail. A third-party SMTP service with its own login works the same way.
Relay connector: in the Exchange admin center go to Mail flow → Connectors → Add a connector, choose Connection from: Your organization's email server, and authenticate by the office's static public IP. Find your MX host with our checker.
In Web Based Management → Network → Network → Protocol → POP3/IMAP4/SMTP Client (POP3/SMTP on older models), enter the values below and set Server Authentication Method to None.
Add the office IP to SPF (ip4:203.0.113.10) with the SPF generator, then send a test scan to an outside address.
Other ways out: direct send to the MX host on port 25 needs no connector but only reaches your own mailboxes, and re-enabling SMTP AUTH for just the scanner mailbox works only until Microsoft's final removal date (how, timeline).

SMTP server	`yourdomain-com.mail.protection.outlook.com`
SMTP port	`25`
Server Authentication Method	`None`
SMTP over SSL/TLS	`TLS (STARTTLS) if supported, otherwise None`
Machine's e-mail address	`scanner@yourdomain.com (any address in your domain)`
Exchange connector	`Connection from: Your organization's email server; authenticated by your static public IP`

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)