Lexmark: email through Microsoft 365 after Basic auth ends

Short answer: Lexmark printers support Microsoft 365 OAuth 2.0 from firmware FW24 (240.043 or later). Update, register the printer in the Embedded Web Server's Email settings (Set Up OAuth 2.0 for Email Server), then use smtp.office365.com on port 587. Printers that can't run FW24 need an SMTP relay connector.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

Lexmark says its printers support OAuth 2.0 for Outlook Live and Microsoft 365 starting with the FW24 firmware release; the FW24 release notes list support for OAuth2.0 with Microsoft SMTP servers from 240.043. FW24 is published for Lexmark's firmware families CT, GM, GV, GW, LS, MM, PC, PM, SN and ZJ (the version looks like CXTPC.240.229). In the Embedded Web Server go to Settings > Email > Set Up OAuth 2.0 for Email Server and click Register. Fax server workflows can use their own OAuth registration, and the control-panel email setup wizard can't set up OAuth. A list of model names per firmware family: not documented by Lexmark in one place, so check the firmware version on your printer.

What you will see when it breaks

"Email Transmission Failure" on the control panel, followed by a printed Scan Log (Lexmark)
"Connection Failure <535>": user name and password not accepted (Lexmark Scan Log code)
"Connection Failure <530>": the authentication setting doesn't match what the server requires (Lexmark Scan Log code)
Status "Registration required" under Set Up OAuth 2.0 for Email Server: the printer isn't registered yet (Lexmark)
535 5.7.139 Authentication unsuccessful, basic authentication is disabled (reported)

Best fix

Update the printer to FW24 (firmware 240.043 or later) from Lexmark's drivers and downloads page.
In the Microsoft 365 admin center, open the scanner's mailbox (Users > Active users > Mail > Manage email apps) and tick Authenticated SMTP. OAuth sign-in still needs SMTP AUTH on for that mailbox.
In the Embedded Web Server, open Settings > Email > Set Up OAuth 2.0 for Email Server. The Status should say Registration required; click Register.
Go to https://microsoft.com/devicelogin, enter the code from the Embedded Web Server within 15 minutes, sign in with the scanner mailbox and follow the prompts. The Status changes to Registered.
Open Settings > Email > Email Setup: Primary SMTP Gateway smtp.office365.com, Primary SMTP Gateway Port 587, Use SSL/TLS Required, Reply Address = the registered mailbox, SMTP Server Authentication OAuth2.0, Device-Initiated Email and User-Initiated Email Use Device SMTP Credentials. Click Save.
Fax server workflows: in Settings > Fax, open Fax Server Setup and tick Use Email SMTP Server, or register a separate address under Set Up OAuth 2.0 for Fax Server.
Send a test scan. If the panel shows Email Transmission Failure, read the code on the printed Scan Log. More on the 535 5.7.139 error.

If it can't do OAuth

Firmware still not 240.x after updating? Then the model has no OAuth, and a Lexmark cloud alternative for e-mail is not documented by Lexmark. Use an SMTP relay connector.
In the Exchange admin center go to Mail flow > Connectors > Add a connector, choose Connection from: Your organization's email server, and let it trust the office's static public IP (one nobody else uses) or a TLS certificate for your domain. Relay only works from your own network, not from a cloud host such as Azure.
In the Embedded Web Server, open Settings > Email > Email Setup (older models: Settings > Email/FTP Settings > Email Settings > Setup Email Server) and enter the values in the table.
Add the office's public IP to your SPF record, for example v=spf1 ip4:203.0.113.10 include:spf.protection.outlook.com -all, with our SPF generator. Run our checker to see your MX host and current SPF.
Only scanning to colleagues? Direct send uses the same MX host and port 25 with no connector and no login, but it can't deliver to outside addresses, and Microsoft says it is working on turning it off by default.
Or give the device its own SMTP login at an email sending service (for example Amazon SES, Postmark, Brevo or Mailgun) and publish that service's SPF and DKIM records for your domain.
Stopgap only: an admin can turn SMTP AUTH back on for just the device's mailbox with Set-CASMailbox -Identity scanner@yourdomain.com -SmtpClientAuthenticationDisabled $false. It fails while security defaults are on and ends when Microsoft sets the final removal date (to be announced in the second half of 2027). See the timeline.

Primary SMTP Gateway	`yourdomain-com.mail.protection.outlook.com (your MX host)`
Primary SMTP Gateway Port	`25`
Use SSL/TLS	`Negotiate`
SMTP Server Authentication	`No authentication required`
Device-Initiated Email	`None`
User-Initiated Email	`None`
Reply Address	`scanner@yourdomain.com (any address in your Microsoft 365 domain)`

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)