Epson WorkForce and EcoTank business: email through Microsoft 365 after Basic auth ends

Short answer: Epson added OAuth2 for Microsoft Exchange Online to listed WorkForce, WorkForce Pro, WorkForce Enterprise and EcoTank models by firmware update. Update, then in Web Config set Authentication Method to OAuth2 under Network, Email Server, Basic and sign in. Other models need an SMTP relay connector.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

Epson's FAQ OAuth2.0 support for Epson printers and scanners (KA-02047) lists the models that got OAuth2.0 for Microsoft Exchange Online and says to install the latest firmware. Business models on the list include WorkForce WF-3820/3825, WF-4820/4830, WF-7820/7830/7840, WorkForce Pro WF-C5290/C5390, WF-C5710/C5790/C5810/C5890, WF-M5299/M5399/M5799/M5899 and EM-C800/EM-C8100, WorkForce Enterprise AM-C4000/C5000/C6000, AM-C400/C550 and WF-C20590/C21000, and EcoTank ET-5800/5850/5880, ET-16600/16650/16680, ET-8700 and ET-M16600. In Web Config (logged in as administrator) go to Network tab > Email Server > Basic, set Authentication Method to OAuth2 and Email service to Microsoft Exchange Online, then click Sign In. Minimum firmware versions: not documented by Epson. Models not on the list: OAuth not documented by Epson.

What you will see when it breaks

"SMTP server authentication error. Check the followings. - Authentication Method - Authenticated Account -Authenticated Password" (Epson connection test)
"Sender's Email Address is incorrect. Change to the email address for your email service." (Epson connection test)
"Connection to SMTP server failed. Change Secure Connection to STARTTLS." (Epson connection test)
535 5.7.139 Authentication unsuccessful, basic authentication is disabled (reported)
535 5.7.3 Authentication unsuccessful (reported)

Best fix

Check that your model is on Epson's OAuth2.0 list (FAQ KA-02047) and install the latest firmware.
In the Microsoft 365 admin center, open the scanner's mailbox (Users > Active users > Mail > Manage email apps) and tick Authenticated SMTP. OAuth sign-in still needs SMTP AUTH on for that mailbox. Epson says the account that signs in needs the Cloud Application Administrator role.
Open Web Config, log in as administrator and go to Network tab > Email Server > Basic. Set Authentication Method to OAuth2 and Email service to Microsoft Exchange Online.
Click Sign In > Sign in with Microsoft, copy the code, open the link shown, enter the code and sign in. Accept consent on behalf of your organization. When the status says Signed in, click OK.
Set Sender's Email Address to the signed-in mailbox, run the connection test and send a test scan. More on the 535 5.7.139 error.

If it can't do OAuth

Model not on Epson's list? If it shows Scan to Cloud, Epson Connect can e-mail scans to destinations you register in Epson Connect, but the mail comes from the printer's Epson Connect address, not your domain. To send from your domain, use an SMTP relay connector.
In the Exchange admin center go to Mail flow > Connectors > Add a connector, choose Connection from: Your organization's email server, and let it trust the office's static public IP (one nobody else uses) or a TLS certificate for your domain. Relay only works from your own network, not from a cloud host such as Azure.
In Web Config, open Network tab > Email Server > Basic and enter the values in the table, then run the connection test.
Add the office's public IP to your SPF record, for example v=spf1 ip4:203.0.113.10 include:spf.protection.outlook.com -all, with our SPF generator. Run our checker to see your MX host and current SPF.
Only scanning to colleagues? Direct send uses the same MX host and port 25 with no connector and no login, but it can't deliver to outside addresses, and Microsoft says it is working on turning it off by default.
Or give the device its own SMTP login at an email sending service (for example Amazon SES, Postmark, Brevo or Mailgun) and publish that service's SPF and DKIM records for your domain.
Stopgap only: an admin can turn SMTP AUTH back on for just the device's mailbox with Set-CASMailbox -Identity scanner@yourdomain.com -SmtpClientAuthenticationDisabled $false. It fails while security defaults are on and ends when Microsoft sets the final removal date (to be announced in the second half of 2027). See the timeline.

Authentication Method	`Off`
Sender's Email Address	`scanner@yourdomain.com (any address in your Microsoft 365 domain)`
SMTP Server Address	`yourdomain-com.mail.protection.outlook.com (your MX host)`
SMTP Server Port Number	`25`
Secure Connection	`STARTTLS`
Certificate Validation	`Disable, or Enable after importing the CA certificate`

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)