FUJIFILM Apeos and ApeosPort (formerly Fuji Xerox) scan to email with Microsoft 365: email through Microsoft 365 after Basic auth ends

Short answer: Install FUJIFILM's countermeasure firmware, then set Service Provider to Exchange Online / Outlook.com under Network → Protocols → SMTP in Internet Services and sign in with the device mailbox (OAuth 2.0). Models FUJIFILM lists as Type (2) get no fix: use a relay connector or another mail service.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

FUJIFILM Business Innovation fixes the Basic auth switch-off with firmware. After the update, the SMTP page in Internet Services (CentreWare Internet Services on older models) has a Service Provider setting. Exchange Online / Outlook.com signs in with OAuth 2.0: the device shows a code, you enter it on the sign-in page and sign in with the sending mailbox. A Global Administrator must consent once per tenant; FUJIFILM says the app reads users' basic information and accesses their email. Firmware depends on model and region, for example Apeos C3060/C2560/C2060 21.50.7 (India, Europe, Middle East, North America, Africa) or Apeos 3560/3060/2560 1.50.4 (Asia except India, and Oceania). Some models are still Under planning. Type (2) models (many ApeosPort-IV, ApeosPort-V and DocuCentre-IV/V devices) get no fix; FUJIFILM says to use an email service other than Exchange Online. Each device needs its own mailbox account (several devices may share one), and the From address is always that account.

What you will see when it breaks

"027-779: Authentication failure with SMTP-AUTH" (FUJIFILM notice; in job records and error history)
"016-781: Server connection error" (FUJIFILM notice)
Scan or fax send fails with an error on the panel and an unsent report; the error history isn't shown on the panel, only in Internet Services (FUJIFILM notice)
"SendAsDenied" after switching to OAuth (FUJIFILM setup guide: the From field is still editable or uses the logged-in user's address)
Authentication error when sending after OAuth setup (FUJIFILM setup guide: the Device Email Address isn't the account's UPN, the sender was changed, or Login Credentials for Email Send went back to Remotely Authenticated User)
Sign-in with the code fails (FUJIFILM setup guide: a Conditional Access policy such as Block Device Code Flow is blocking it)

Best fix

Find your model in FUJIFILM's product list for your region. Note the workaround type, the countermeasure firmware and whether it uses setup guide A or B. To list every device that still logs in with a password, run the free SMTP AUTH sender script.
Type (1): install the countermeasure firmware. Type (2), or firmware still Under planning: go to the fallback section.
Open the admin consent link from FUJIFILM's setup guide in a browser, sign in as a Global Administrator and click Accept. Do this once per tenant.
Lock the sender. Guide A: Apps → Email → Common Settings → "From" Field, disable Use Email Address of Logged-In User and set Edit "From" Field to Disabled. Guide B: Properties → Services → Email → General → From Address → Edit, set both [From:] edit options to No.
Log in to Internet Services as system administrator and open Network → Protocols → SMTP (guide B: Connectivity → Protocols → SMTP Server → General). If Login Credentials for Email Send is Remotely Authenticated User, change it to System. Set Service Provider to Exchange Online / Outlook.com and click Save (guide B: Apply). Leave the other fields as they are.
Click Next on Enter Authentication Code (guide B: Open Authentication Page), enter the code shown, then sign in with the sending mailbox. Keep Authenticated SMTP on for that mailbox in the Microsoft 365 admin center: OAuth logins still use SMTP AUTH.
The signed-in address becomes the Device Email Address. It must match the account's UPN; if the primary address differs, change it to the UPN under Device Details. Don't type an SMTP server on the control panel afterwards: that resets Service Provider to Not Selected. Send a test scan.

If it can't do OAuth

Type (2) model or no firmware yet? Create a relay connector that trusts your office's static public IP and point the device's SMTP server at your MX host (for example contoso-com.mail.protection.outlook.com) on port 25 with no login. These are Microsoft's relay values; FUJIFILM doesn't document them and only says to use an email service other than Exchange Online.
Microsoft lists relay for devices that can't sign in to a mailbox; it needs a static IP and doesn't work from a dynamic one.
Stopgap only: an admin can turn Basic auth for SMTP AUTH back on for now. It ends when Microsoft removes it for good; the date is due in the second half of 2027. See the SMTP AUTH change.

Internet Services (guide A)	`Network > Protocols > SMTP > Service Provider: Exchange Online / Outlook.com`
CentreWare Internet Services (guide B)	`Properties > Connectivity > Protocols > SMTP Server > General > Service Provider`
Login Credentials for Email Send	`System (not Remotely Authenticated User)`
From field (guide A)	`Apps > Email > Common Settings > "From" Field: Use Email Address of Logged-In User disabled, Edit "From" Field Disabled`
Admin consent	`Global Administrator, once per tenant; app (client) ID c88859d7-e6a2-48cb-acee-669df3387654`
Device Email Address	`Must equal the UPN of the signed-in account`
Firmware examples	`Apeos C3060/C2560/C2060: 21.50.7. Apeos 3560/3060/2560: 21.50.7, or 1.50.4 in Asia (except India) and Oceania`
Error codes	`027-779 (SMTP-AUTH failure), 016-781 (server connection error)`

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)

Rather have it done for you? I move your devices and apps on Fiverr – relay, Direct Send or OAuth, tested, from $25.

Sources

Did this fix it?