Microsoft 365 SMTP relay connector (any printer, scanner, NAS or app): email through Microsoft 365 after Basic auth ends

Short answer: Create an inbound connector in the Exchange admin center (Mail flow → Connectors, from Your organization's email server to Office 365) that trusts your TLS certificate or static public IP. Point the device at your MX host on port 25 with TLS and no login, and add the IP to SPF.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

A relay connector uses neither OAuth nor a password. Exchange Online recognises the device by its TLS certificate (recommended) or by a static public IP that belongs only to your organization, so it keeps working after the SMTP AUTH Basic auth switch-off. It suits printers, scanners and old apps that can't do OAuth. If a device can do OAuth, Microsoft lists client submission with Modern authentication (SMTP.Send, or SMTP.SendAsApp for unattended apps) before relay, and apps you control can use Graph sendMail. Relay can't be used for mail from a third-party hosted service such as Azure, and dynamic IP addresses aren't supported.

What you will see when it breaks

"550 5.7.64 TenantAttribution; Relay Access Denied" (Microsoft Learn: no connector matched the sending IP or certificate, often after an IP change or a renewed certificate)
"4.4.62 Mail sent to the wrong Office 365 region" (Microsoft Learn: same cause as 5.7.64)
"550 5.7.64 Relay Access Denied ATTR36" (Microsoft Learn: the certificate's domain isn't a verified accepted domain in your tenant)
"Client was not authenticated to send anonymous mail during MAIL FROM" (Microsoft Learn: the device points at smtp.office365.com instead of your MX host)
"550 5.7.68 TenantInboundAttribution; Direct Send not allowed for this organization from unauthorized sources" (Microsoft Exchange Team: RejectDirectSend is on and the message didn't match a connector)
External mail stops after an ISP or network change (Microsoft Learn: the static IP changed; update the connector and SPF)
Mail from the device lands in Junk (Microsoft Learn: add the device's IP to your SPF record)

Best fix

Find your MX host: Microsoft 365 admin center → Settings → Domains → your domain → DNS records → MX Points to address or value, for example contoso-com.mail.protection.outlook.com. Our checker shows it too.
Choose how Exchange Online will recognise the device: a TLS certificate whose Subject or SAN contains one of your accepted domains (recommended), or a static public IP that no other organization uses.
Exchange admin center → Mail flow → Connectors → Add a connector. Connection from: Your organization's email server. Connection to: Office 365 (set automatically). Name it, keep Turn it on ticked and leave Retain internal Exchange email headers unticked.
On Authenticating sent email, pick the certificate option and type the accepted domain from the certificate (*.contoso.com if it names several hosts), or pick the IP option and type the device's public IP. Review, then Create connector.
On the device: server = your MX host (never an IP address), port 25, TLS/STARTTLS on (TLS 1.2 or 1.3), no username or password, From = any address in your accepted domain. It doesn't need a mailbox or licence.
Publish the IP in SPF, for example v=spf1 ip4:203.0.113.10 include:spf.protection.outlook.com -all. Keep one SPF record per domain; the SPF generator merges it for you.
Send a test to an outside address. If it bounces, compare the code with the common errors on this page.

If it can't do OAuth

Port 25 blocked by your ISP, or no static IP? Use OAuth instead: smtp.office365.com port 587 with XOAUTH2 (SMTP.Send delegated, SMTP.SendAsApp application). SMTP AUTH must stay enabled on that mailbox.
Apps you can change: send with Microsoft Graph sendMail and the Mail.Send permission.
Device or app in Azure or another cloud: relay won't work there. Use OAuth, Graph, or a third-party SMTP service with its own login, and add its include with the SPF generator.
Stopgap only: an admin can turn SMTP AUTH back on for one mailbox while you migrate. See 535 5.7.139.

Server / smart host	`Your MX endpoint, e.g. contoso-com.mail.protection.outlook.com (not an IP address)`
TCP port	`25`
TLS / STARTTLS	`Enabled (TLS 1.2 or 1.3)`
Authentication	`None on the device; the connector trusts your certificate (Subject or SAN = accepted domain) or a static public IP only you use`
From address	`Any address in an accepted domain; no mailbox or licence needed`
Connector	`Connection from: Your organization's email server. Connection to: Office 365`
SPF	`v=spf1 ip4:203.0.113.10 include:spf.protection.outlook.com -all`

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)