HP printers and MFPs: email through Microsoft 365 after Basic auth ends

Short answer: HP Enterprise and Managed MFPs on current FutureSmart 5 firmware can sign in to Microsoft 365 with OAuth 2.0 in the Scan to Email wizard. HP says LaserJet Pro MFPs can't: use HP's cloud Scan Destinations or a Microsoft 365 relay connector before Basic auth goes off in December 2026.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

LaserJet, PageWide and OfficeJet Enterprise / Managed MFPs (FutureSmart 5): HP's firmware readmes refer to OAuth2.0 in the Embedded Web Server's Scan to Email setup wizard, and FutureSmart 5.9 fixed an error in that step. The readmes don't name the first version with OAuth, so install the newest FutureSmart 5 bundle for your model (5.10.0.7, dated August 2026, in the readmes we checked) and start from Scan/Digital Send → E-mail Setup or the E-mail Setup Wizard. LaserJet Pro MFPs: HP states they do not support OAuth 2.0 for SMTP as of spring 2026. OfficeJet Pro, ENVY, Smart Tank and other home models: OAuth for SMTP is not documented by HP. HP Workpath: an HP-made Microsoft 365 email app is not documented by HP.

What you will see when it breaks

535 5.7.139 Authentication unsuccessful, basic authentication is disabled. (Microsoft's reply; reported in Microsoft Q&A)
"unexpected error" in the Embedded Web Server while setting up OAuth2.0 in the Scan to Email wizard (HP FutureSmart readme; fixed in FutureSmart 5.9)
Reported: the OAuth sign-in step stays on "Getting Code"; one admin fixed it by turning off IPv6 on the printer (HP Community)
Reported: scan to email fails with event 44.10.01 SMTP protocol error even though the Microsoft sign-in succeeded (HP Community)
Reported: the test email fails with an authentication error while the same mailbox still works in Outlook.

Best fix

Install the latest FutureSmart 5 firmware for the printer from HP's support site, then check that OAuth 2.0 is offered in the Scan to Email setup wizard.
Use a licensed mailbox for the scanner and keep Authenticated SMTP on for it: OAuth replaces the password, not SMTP AUTH itself.
In the Embedded Web Server open Scan/Digital Send → E-mail Setup, tick Enable Send to E-mail, and under Outgoing E-mail Servers (SMTP) click Add: smtp.office365.com, Port Number 587, Enable SMTP SSL Protocol on.
At the authentication step choose OAuth 2.0 and finish the Microsoft sign-in with the scanner mailbox.
Set Default From to that same mailbox. Microsoft rejects other From addresses unless the mailbox has Send As permission (5.7.60).
Send a test from Summary and Test, then open the SMTP AUTH clients report in the Exchange admin center: the printer should no longer show Basic auth.

If it can't do OAuth

LaserJet Pro MFPs: HP's own answer is cloud Scan Destinations. Pair the printer with the HP Cloud, then in the HP Smart Admin Portal go to Printers → your printer → Scan Destinations → Scan to Email → Add Contact. Scans go out through HP's relay, not your tenant; HP says availability varies by region and model.
OfficeJet Pro, ENVY and other home models: use Scan to Email with an HP account, or Shortcuts set up in the HP Smart app on models that only support those, instead of an SMTP login.
Relay connector (any HP with a static public IP): in the Exchange admin center go to Mail flow → Connectors → Add a connector, choose Connection from: Your organization's email server, and authenticate by the office's public IP. Find your MX host with our checker.
In the EWS add an SMTP server with the values below and choose Server does not require authentication. Default From can be any address in your domain; it doesn't need a mailbox.
Add the office IP to SPF (ip4:203.0.113.10) with the SPF generator, then send a test scan to an outside address.
Other ways out: direct send to the MX host on port 25 needs no connector but only reaches your own mailboxes; a third-party SMTP service gives the printer its own login; and re-enabling SMTP AUTH for just the scanner mailbox works only until Microsoft's final removal date (how, timeline).

Server Name (SMTP server)	`yourdomain-com.mail.protection.outlook.com`
Port Number	`25`
Authentication	`Server does not require authentication`
Enable SMTP SSL Protocol	`On if the test passes on port 25; HP's older help ties it to port 587, so leave it off if the test fails`
Default From	`scanner@yourdomain.com (any address in your domain)`
Exchange connector	`Connection from: Your organization's email server; authenticated by your static public IP`

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)