Konica Minolta bizhub: email through Microsoft 365 after Basic auth ends

Short answer: Most bizhub i-Series and many older bizhub models get Microsoft 365 OAuth 2.0 from firmware F233-G00-T8(00) or F000-GC3-YE(00). After the update, fetch the token on the control panel. Models marked N/A get no update: use an SMTP relay connector or scan to a folder.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

Konica Minolta has released OAuth 2.0 firmware for its main bizhub models (notice updated 9 March 2026). Product Group #1, bizhub i-Series models such as C250i, C300i, C360i, C450i, C550i, C650i, C750i, the C251i–C751i successors, C3300i/C4000i, C3350i/C4050i and the mono 226i–950i, needs F233-G00-T8(00). Product Group #2, for example C258/C308/C368, C458/C558/C658, C659/C759, 308e/368e, 458e/558e/658e, 758/808/958 and C3351/C3851, needs F000-GC3-YE(00). Smaller A4 models such as bizhub 4000i/5000i, 4020i/5020i, C3100i/C3120i, 225i/245i and 4702P get OAuth for Exchange Online at model-specific versions. The token is fetched on the control panel at Utility > Administrator > Network > E-mail Setting > E-mail TX (SMTP) > OAuth Settings (Group #2: Utility > Administrator Settings > Network Settings > E-Mail Settings > E-Mail TX (SMTP) > Detail Settings > OAuth 2.0); Konica Minolta says this can't be done in Web Connection. No firmware is planned for models marked N/A, such as bizhub C226/C256/C266, 266/306, 4052/4752, 4050/4750, C3110, C654e/C754e and 206/226/246.

What you will see when it breaks

Device-side error text for a refused password login: not documented by Konica Minolta (its notice only says the e-mail functions "may result in errors").
535 5.7.139 Authentication unsuccessful, basic authentication is disabled (reported)
535 5.7.3 Authentication unsuccessful (reported)
"The OAuth authentication fails when sending Microsoft E-mails." (Konica Minolta OAuth setup guide; its fix is to tick Authenticated SMTP for the mailbox)
A warning on the [Information] screen when the administrator's token has expired (Konica Minolta OAuth setup guide).

Best fix

Ask your Konica Minolta dealer for the OAuth firmware: F233-G00-T8(00) for Group #1 or F000-GC3-YE(00) for Group #2. Konica Minolta applies it remotely or at the next service visit.
In the Microsoft 365 admin center, open the scanner's mailbox (Users > Active users > Mail > Manage email apps) and tick Authenticated SMTP. OAuth sign-in still needs SMTP AUTH on for that mailbox.
Enter the Microsoft 365 mailbox as the administrator address: [System Settings] > [Machine Setting] > [Administrator Registration] > [E-mail Address] in Web Connection. Group #2 models also need the Web browser function on first: Utility > Administrator Settings > Network Settings > Web Browser Setting > Web Browser Usage Settings.
On the control panel, open OAuth Settings (path above), set OAuth 2.0 to ON and OAuth 2.0 Provider to Microsoft, tap OK and sign in. Refresh Tokens (Administrator) changes from Required to Acquired.
Set the SMTP server address to smtp.office365.com under [Network] > [E-mail Setting] > [E-mail TX (SMTP)], with Start TLS on port 587 (Microsoft's values). Don't set both the minimum and maximum TLS version to TLSv1.3: Konica Minolta says Microsoft OAuth then fails.
Choose the sender in Change From Address Setting: Fix Administrator Address sends every scan with the admin token; Login User Address makes each user sign in on the panel the first time.
Send a test scan. The refresh token lasts several months; when the [Information] warning appears, tap [Acquire] to sign in again. More on the 535 5.7.139 error.

If it can't do OAuth

No OAuth firmware for your model (marked N/A or not listed)? Konica Minolta's own workarounds are scanning to SMB, Home, FTP, WebDAV or Box instead of e-mail, or using a mail service other than Exchange Online. To keep Scan to E-mail on Microsoft 365, use an SMTP relay connector.
In the Exchange admin center go to Mail flow > Connectors > Add a connector, choose Connection from: Your organization's email server, and let it trust the office's static public IP (one nobody else uses) or a TLS certificate for your domain. Relay only works from your own network, not from a cloud host such as Azure.
On the panel, open Utility > Administrator > Network > E-mail Setting > E-mail TX (SMTP) and enter the values in the table. Under Detail Settings, turn SMTP Authentication and POP Before SMTP OFF.
Add the office's public IP to your SPF record, for example v=spf1 ip4:203.0.113.10 include:spf.protection.outlook.com -all, with our SPF generator. Run our checker to see your MX host and current SPF.
Only scanning to colleagues? Direct send uses the same MX host and port 25 with no connector and no login, but it can't deliver to outside addresses, and Microsoft says it is working on turning it off by default.
Or give the device its own SMTP login at an email sending service (for example Amazon SES, Postmark, Brevo or Mailgun) and publish that service's SPF and DKIM records for your domain.
Stopgap only: an admin can turn SMTP AUTH back on for just the device's mailbox with Set-CASMailbox -Identity scanner@yourdomain.com -SmtpClientAuthenticationDisabled $false. It fails while security defaults are on and ends when Microsoft sets the final removal date (to be announced in the second half of 2027). See the timeline.

E-mail TX Setting	`ON`
SMTP Server Address	`yourdomain-com.mail.protection.outlook.com (your MX host)`
SSL/TLS Settings	`Start TLS`
Port No.	`25`
SMTP Authentication	`OFF`
Device Mail Address	`scanner@yourdomain.com (any address in your Microsoft 365 domain)`

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)