Ricoh MFPs and printers: email through Microsoft 365 after Basic auth ends

Short answer: Ricoh has released OAuth 2.0 firmware for Exchange Online (from July 2025) for the IM, MP, SP and P models on its support list. Update, then in Web Image Monitor go to Device Management → Configuration → Email and pick OAuth 2.0 (for Exchange Online). Models not on the list need a relay connector.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

Ricoh's support notice (updated 6 February 2026) lists OAuth 2.0 firmware as available for its color and monochrome IM, MP and SP MFPs, Aficio MP models, IP, P and SP printers, and small models such as the M C250FW and P C300W. Most models update with the RICOH Firmware Update Tool; production Pro models and the IM 2702 get firmware from your Ricoh representative. Then in Web Image Monitor → Device Management → Configuration → Email (under Device Settings) set Authentication Method for Sending Email to OAuth 2.0 (for Exchange Online). Ricoh also warns that some models, including some with OAuth, need separate firmware for Microsoft's newer TLS cipher suites (released late February to late April 2026).

What you will see when it breaks

Not documented by Ricoh: its notice only says an error occurs when scan-to-email, Internet Fax, fax-to-email and email notifications send through Exchange Online.
535 5.7.139 Authentication unsuccessful, basic authentication is disabled. (Microsoft's reply; reported in Microsoft Q&A)
"(Authenticated)" missing next to Start Authentication on the Email page means the Microsoft sign-in didn't finish (Ricoh setup guide)
With OAuth, mail sent with a user-chosen sender fails unless it matches the authenticated address (Ricoh setup guide)
Reported: 535 errors or timeouts with OAuth when the tenant hasn't given admin consent to Ricoh's app (Microsoft Q&A)

Best fix

Find your model on Ricoh's OAuth 2.0 list and update it with the RICOH Firmware Update Tool. Keep Authenticated SMTP on for the scanner mailbox in Microsoft 365.
Log in to Web Image Monitor as administrator → Device Management → Configuration → Email (under Device Settings) and set Authentication Method for Sending Email to OAuth 2.0 (for Exchange Online). Ricoh then fixes port 587, STARTTLS and SMTP Authentication on.
Set SMTP Server Name to smtp.office365.com, and enter the scanner mailbox as both Authentication Email Address and Authentication User Name.
Click Start Authentication next to OAuth 2.0 Authentication, note the code, click Microsoft, enter the code and sign in with the scanner mailbox.
Back on the machine's page click OK, check that "(Authenticated)" appears next to Start Authentication, then click OK again.
Enter the same mailbox as Administrator Email Address and leave Auto Specify Sender Name on: with OAuth, Ricoh only sends when the sender matches the signed-in address. Then send a test scan.

If it can't do OAuth

Ricoh's own advice for models without OAuth firmware: send without email, or use an email service other than Exchange Online. Ricoh doesn't name a cloud scan-to-email service in these notices.
Relay connector: in the Exchange admin center go to Mail flow → Connectors → Add a connector, choose Connection from: Your organization's email server, and authenticate by the office's static public IP. Find your MX host with our checker.
In Web Image Monitor → Device Management → Configuration → Email, set Authentication Method for Sending Email to anything other than OAuth 2.0 (for Exchange Online) and enter the values below.
If the model is on Ricoh's TLS cipher list with no update, set Use Secure Connection (SSL) to Off: Microsoft lists TLS as optional for SMTP relay.
Add the office IP to SPF (ip4:203.0.113.10) with the SPF generator, then send a test scan to an outside address.
Other ways out: direct send to the MX host on port 25 needs no connector but only reaches your own mailboxes; a third-party SMTP service gives the device its own login; and re-enabling SMTP AUTH for just the scanner mailbox works only until Microsoft's final removal date (how, timeline).

SMTP Server Name	`yourdomain-com.mail.protection.outlook.com`
SMTP Port No.	`25`
SMTP Authentication	`Off`
Use Secure Connection (SSL)	`STARTTLS (Off if the model can't do current TLS)`
Administrator Email Address	`scanner@yourdomain.com (any address in your domain)`
Exchange connector	`Connection from: Your organization's email server; authenticated by your static public IP`

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)