Kyocera TASKalfa and ECOSYS: email through Microsoft 365 after Basic auth ends

Short answer: Newer Kyocera TASKalfa MZ and ECOSYS MA/PA models sign in to Microsoft 365 with OAuth2 in Command Center RX, and TASKalfa xx54ci and x004i models get it by firmware update. Older Kyocera devices can use Kyocera's free Exchange Online Connector or an SMTP relay connector.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

Kyocera lists native OAuth 2.0 for SMTP on TASKalfa MZ2501ci–MZ7001ci, MZ5001i–MZ7001i, MZ3200i/MZ4000i and MA3500ci/MA4500ci, and on ECOSYS models such as MA2101/MA2600, PA2101/PA2600, MA3500/MA4000/MA4500, MA5500ifx/MA6000ifx, PA3500–PA6000 and P4060dn/P8060dn. TASKalfa 2554ci–7054ci and 5004i–7004i are on Kyocera UK's list but need a firmware update (Kyocera Australia: end of March 2026 for the 2554ci). In Command Center RX go to Function Settings > E-mail > SMTP > Authentication Protocol, choose OAuth2, then OAuth2 Status > Authorize. Kyocera says only the mail address set for the device can be used, not a separate login per user. Firmware version numbers: not documented by Kyocera.

What you will see when it breaks

"1102 – Login Username and/or Password is incorrect." (Kyocera error code)
"3101 – SMTP Server rejected email. Refer issue to IT or check Authentication/Sender address" (Kyocera error code)
"1104 – SMTP denied access." (Kyocera error code)
535 5.7.139 Authentication unsuccessful, basic authentication is disabled (reported)

Best fix

Install the latest firmware and check that your model is on Kyocera's OAuth 2.0 list.
In the Microsoft 365 admin center, open the scanner's mailbox (Users > Active users > Mail > Manage email apps) and tick Authenticated SMTP. OAuth sign-in still needs SMTP AUTH on for that mailbox. Whoever authorizes the device must be allowed to grant consent for your organization.
In Command Center RX, open Network Settings > Protocol: set SMTP (E-mail TX) under Send Protocols to On and SMTP Security to STARTTLS, then Submit.
Open Function Settings > E-mail: SMTP Server Name smtp.office365.com, SMTP Port Number 587, Authentication Protocol OAuth2, then Submit.
Click OAuth2 Status > Authorize, copy the code shown under Microsoft Exchange Server Authorization, open the link, paste the code and sign in (with MFA if asked). Choose Consent on behalf of your organization > Accept, then refresh in Command Center RX and click OK and Submit.
Set Sender Address to the same mailbox and click Test. Behind a proxy? Set it in Network Settings > TCP/IP (Proxy Settings) before you authorize. More on the 535 5.7.139 error.

If it can't do OAuth

Kyocera's free Exchange Online Connector (Windows PC or server, 4-core CPU, 8 GB RAM) signs in to Microsoft 365 with OAuth for the device, with no firmware change. Install it, click Add, sign in with the scanner mailbox (Authenticated SMTP must be on), then click Start.
Point the device at the connector in Function Settings > E-mail: SMTP Server Name = the connector PC's IP, SMTP Port Number and SMTP Security = the values set in the connector (587 with STARTTLS, or 25 unencrypted), SMTP Server Timeout 60 or more, Authentication Protocol On, Authentication as Other, and the Login User Name and Login Password the connector shows.
No PC to spare? Use an SMTP relay connector instead. In the Exchange admin center go to Mail flow > Connectors > Add a connector, choose Connection from: Your organization's email server, and let it trust the office's static public IP (one nobody else uses) or a TLS certificate for your domain. Relay only works from your own network, not from a cloud host such as Azure.
Enter the relay values from the table in Command Center RX (Function Settings > E-mail; SMTP Security is under Network Settings > Protocol).
Add the office's public IP to your SPF record, for example v=spf1 ip4:203.0.113.10 include:spf.protection.outlook.com -all, with our SPF generator. Run our checker to see your MX host and current SPF.
Only scanning to colleagues? Direct send uses the same MX host and port 25 with no connector and no login, but it can't deliver to outside addresses, and Microsoft says it is working on turning it off by default. Or give the device its own SMTP login at an email sending service (for example Amazon SES, Postmark, Brevo or Mailgun) and publish that service's SPF and DKIM records for your domain.
Stopgap only: an admin can turn SMTP AUTH back on for just the device's mailbox with Set-CASMailbox -Identity scanner@yourdomain.com -SmtpClientAuthenticationDisabled $false. It fails while security defaults are on and ends when Microsoft sets the final removal date (to be announced in the second half of 2027). See the timeline.

SMTP (E-mail TX), under Network Settings > Protocol	`On`
SMTP Security	`STARTTLS`
SMTP Server Name	`yourdomain-com.mail.protection.outlook.com (your MX host)`
SMTP Port Number	`25`
Authentication Protocol	`Off`
Sender Address	`scanner@yourdomain.com (any address in your Microsoft 365 domain)`

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)