Canon imageRUNNER ADVANCE and i-SENSYS/imageCLASS: email through Microsoft 365 after Basic auth ends

Short answer: imageRUNNER ADVANCE DX and newer imageCLASS/i-SENSYS models can send with Microsoft OAuth 2.0: Remote UI → Settings/Registration → Send (or TX Settings) → OAuth 2.0 (Microsoft) Settings. If that screen is missing after a firmware update, use a Microsoft 365 relay connector or uniFLOW Online.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

imageRUNNER ADVANCE DX: Canon's DX user guides (for example the C3900 series) document OAuth 2.0 for Microsoft Exchange Online. Log in to Remote UI as administrator → Settings/Registration → Send → OAuth 2.0 (Microsoft) Settings → Basic Settings → Edit → tick Use OAuth 2.0 (Microsoft). i-SENSYS / imageCLASS: newer models such as the imageCLASS MF756Cx II / MF752Cdw II have the same screen under Settings/Registration → TX Settings → OAuth 2.0 (Microsoft) Settings. Canon says it can only be set from Remote UI, not the control panel. Canon publishes no model list or minimum firmware for OAuth in the pages we could read, so update the firmware and look for that screen. Older imageRUNNER ADVANCE (non-DX) and i-SENSYS/imageCLASS models: OAuth support not documented by Canon.

What you will see when it breaks

#839: The user name or password specified in Communication Settings is incorrect. (Canon error code list; what a refused password login shows)
#841: no encryption algorithm matches the mail server (Canon error code list; check the TLS setting and firmware)
OAuth 2.0 (Microsoft) Settings: Server Connection Status not "Successfully Connected" or Token Status not "Active" means setup isn't finished (Canon user guide)
Reported: OAuth sending stops after some days until the machine is authorized again (Canon Community)
535 5.7.139 Authentication unsuccessful, basic authentication is disabled. (Microsoft's reply; reported in Microsoft Q&A)

Best fix

Update the firmware, then check the machine's date and time. Canon says to redo the OAuth setup if you change them later.
Use a licensed mailbox for the scanner and keep Authenticated SMTP on for it.
In Remote UI go to Settings/Registration → Send (TX Settings on i-SENSYS/imageCLASS) → OAuth 2.0 (Microsoft) Settings → Basic Settings → Edit, tick Use OAuth 2.0 (Microsoft) and keep Verify Server Certificate on.
As Microsoft Entra ID Authorization Server Endpoint enter https://login.microsoftonline.com/organizations/oauth2/v2.0 (Canon also allows common or consumers), click OK and refresh until Server Connection Status shows Successfully Connected.
Click the link next to the endpoint, enter the User Code at Microsoft before it expires, sign in with the scanner mailbox, then refresh until Token Status shows Active.
In the e-mail settings set the SMTP server to smtp.office365.com with TLS on (Microsoft's values: port 587, TLS 1.2 or later), use the signed-in mailbox as the machine's e-mail address, and send a test scan.

If it can't do OAuth

Relay connector: in the Exchange admin center go to Mail flow → Connectors → Add a connector, choose Connection from: Your organization's email server, and authenticate by the office's static public IP. Find your MX host with our checker.
On imageCLASS/i-SENSYS: Remote UI → Settings/Registration → TX Settings → Email/I-Fax Settings → Edit. On imageRUNNER ADVANCE: the E-Mail/I-Fax Communication Settings. Enter the values below, turn off SMTP Authentication (SMTP AUTH), and restart if asked.
Click Check SMTP Connection (imageCLASS) or send a test scan to an outside address.
Add the office IP to SPF (ip4:203.0.113.10) with the SPF generator so outside recipients don't junk the scans.
uniFLOW Online (Canon's paid cloud print and scan service) lists Microsoft Exchange Online and email as scan destinations, so the device itself needs no SMTP login. Ask your Canon dealer.
Other ways out: direct send to the MX host on port 25 needs no connector but only reaches your own mailboxes; a third-party SMTP service gives the device its own login; and re-enabling SMTP AUTH for just the scanner mailbox works only until Microsoft's final removal date (how, timeline).

SMTP Server	`yourdomain-com.mail.protection.outlook.com`
SMTP port	`25 (Canon's default)`
SMTP Authentication (SMTP AUTH)	`Off`
TLS	`Use TLS for SMTP TX (imageCLASS) or Allow SSL (imageRUNNER ADVANCE): On, STARTTLS if supported`
Email Address (the machine's)	`scanner@yourdomain.com (any address in your domain)`
Exchange connector	`Connection from: Your organization's email server; authenticated by your static public IP`

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)