Sharp MX and BP series: email through Microsoft 365 after Basic auth ends

Short answer: Sharp documents OAuth 2.0 for Microsoft 365 on its BP-series MFPs: choose OAuth 2.0 in the SMTP settings and get the token at the control panel. For MX-series models, OAuth is not documented by Sharp, so plan on an SMTP relay connector, direct send or another mail service.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

Sharp's BP-series manuals (for example BP-70C65, BP-70M65 and BP-71C65) document OAuth 2.0 as the recommended SMTP method for Microsoft 365 and Exchange Online: Settings (Administrator) > System Settings > Network Settings > Service Settings > SMTP tab, Authentication Option OAuth 2.0, Provider Microsoft. The token must be fetched at the machine; Sharp says the setup can't be completed on the web page. For the MX series, OAuth is not documented by Sharp: the MX-2651, MX-3051, MX-3071, MX-3551, MX-3571, MX-4051 and MX-4071 user's manual offers only SMTP Authentication with a user name and password, and the MX-C428F/C528F guide lists Login / Plain for Microsoft 365. Sharp New Zealand says devices without OAuth 2.0 need another email service.

What you will see when it breaks

"Token update failed. Please delete the token and obtain it again." (Sharp BP-series connection test)
Token status "Invalid": the account can't be used or the token has expired (Sharp BP-series manual)
Device-side error text for a refused password login on MX models: not documented by Sharp.
80-0000 on an MX-C304W sending to Microsoft 365 through a connector (reported in Microsoft Q&A)
535 5.7.139 Authentication unsuccessful, basic authentication is disabled (reported)

Best fix

Check that your model's online manual has an OAuth 2.0 AUTHENTICATION section. Sharp documents it for BP-series models such as the BP-70C65, BP-70M65 and BP-71C65.
In the Microsoft 365 admin center, open the scanner's mailbox (Users > Active users > Mail > Manage email apps) and tick Authenticated SMTP. OAuth sign-in still needs SMTP AUTH on for that mailbox.
At the machine, tap Settings (Administrator) > System Settings > Network Settings > Service Settings > SMTP tab and set Primary Server smtp.office365.com, Port Number 587, Enable SSL/TLS on and Sender Address to the mailbox (Microsoft's values).
Set Authentication Option to OAuth 2.0, Provider to Microsoft and Account Name to the mailbox. Tap [Get Token], then OK, and sign in. Token changes from Not Retrieved to Retrieved.
E-mail alerts use a separate SMTP setting (System Settings > System Control > E-mail Alert and Status > SMTP Settings) that needs its own token.
Run the connection test. If the token update failed or the token shows Invalid, tap [Delete] and get a new token. More on the 535 5.7.139 error.

If it can't do OAuth

MX models and other devices without OAuth: Sharp New Zealand says to use another email service, such as your own mail server or a different provider. Through Microsoft 365, that means an SMTP relay connector.
In the Exchange admin center go to Mail flow > Connectors > Add a connector, choose Connection from: Your organization's email server, and let it trust the office's static public IP (one nobody else uses) or a TLS certificate for your domain. Relay only works from your own network, not from a cloud host such as Azure.
On the machine or its web page, open Settings (administrator) > System Settings > Network Settings > Services Settings > SMTP and enter the values in the table, then run Connection Test.
Add the office's public IP to your SPF record, for example v=spf1 ip4:203.0.113.10 include:spf.protection.outlook.com -all, with our SPF generator. Run our checker to see your MX host and current SPF.
Only scanning to colleagues? Direct send uses the same MX host and port 25 with no connector and no login, but it can't deliver to outside addresses, and Microsoft says it is working on turning it off by default.
Or give the device its own SMTP login at an email sending service (for example Amazon SES, Postmark, Brevo or Mailgun) and publish that service's SPF and DKIM records for your domain.
Stopgap only: an admin can turn SMTP AUTH back on for just the device's mailbox with Set-CASMailbox -Identity scanner@yourdomain.com -SmtpClientAuthenticationDisabled $false. It fails while security defaults are on and ends when Microsoft sets the final removal date (to be announced in the second half of 2027). See the timeline.

Primary Server	`yourdomain-com.mail.protection.outlook.com (your MX host)`
Port Number	`25`
Enable SSL	`On (uses STARTTLS)`
SMTP Authentication	`Off`
POP before SMTP	`Off`
Sender Address	`scanner@yourdomain.com (any address in your Microsoft 365 domain)`

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)