Xerox AltaLink and VersaLink: email through Microsoft 365 after Basic auth ends

Short answer: Xerox has OAuth 2.0 firmware (Device Code Flow) for current AltaLink and VersaLink models. In the Embedded Web Server open Apps → Email → SMTP Setup and pick OAuth 2.0 with SMTP (AltaLink) or Service Provider: Exchange Online/Outlook.com (most VersaLink). Unlisted models need a relay connector.

Deadline: Microsoft 365 turns off SMTP AUTH Basic auth by default at the end of December 2026 – dates and background.

Modern authentication (OAuth) support

Xerox's Exchange Online notice (February 2026) lists Device Code Flow firmware as Available Now for the AltaLink B8100, C8100, B8200 and C8200 series and for VersaLink B400/C400, B405/C405, B415/C415, C500/C505, B600 to C605, B610/B615, B620/C620/B625/C625 and the B7000, C7000, B7100 and C7100 series; AltaLink and some VersaLink models also support Client Credentials Flow. Minimum software: AltaLink 81xx/82xx 122.xxx.025.20910, VersaLink B400 to C605 xx.83.11 (PL8-R10). AltaLink: Properties → Apps → Email → Setup → Edit next to SMTP → SMTP Authentication = OAuth 2.0 with SMTP → Device Code Flow (DCF) Configuration. VersaLink: Apps → Email → SMTP Setup → Service Provider = Exchange Online/Outlook.com. Xerox says products not in its list don't support OAuth 2.0 email.

What you will see when it breaks

Best fix

  1. Update the printer to at least the software level above; Xerox keeps the current list at Xerox.com/MSOAuth2.
  2. Have a Microsoft 365 admin approve Xerox's Device Code Flow app at https://www.xerox.com/oauth2-email-admin-consent (optionally limited to the scanner mailbox), and keep Authenticated SMTP on for that mailbox.
  3. AltaLink: Embedded Web Server → Properties → Apps → Email → Setup → Edit next to SMTP → set SMTP Authentication to OAuth 2.0 with SMTP, choose Device Code Flow (DCF) Configuration, save and apply.
  4. VersaLink: Embedded Web Server → Apps → Email → SMTP Setup → set Service Provider to Exchange Online/Outlook.com (it fills in smtp.office365.com, port 587) → OK.
  5. Copy the code, open the Microsoft registration page, enter the code and sign in with the scanner mailbox, then accept the permissions and restart if asked. That mailbox becomes the From address for all device mail.
  6. Test with Test configuration (AltaLink) or the Email app on the control panel (VersaLink).

If it can't do OAuth

  1. Relay connector: in the Exchange admin center go to Mail flow → Connectors → Add a connector, choose Connection from: Your organization's email server, and authenticate by the office's static public IP. Find your MX host with our checker.
  2. In the Embedded Web Server's SMTP settings (AltaLink: Properties → Apps → Email → Setup), enter the values below under Required Information, set no login for SMTP Authentication, and set the From Field.
  3. Add the office IP to SPF (ip4:203.0.113.10) with the SPF generator, then send a test scan to an outside address.
  4. Xerox notes that other providers, such as Gmail, aren't affected by Microsoft's change, so a third-party SMTP service with its own login also works.
  5. Other ways out: direct send to the MX host on port 25 needs no connector but only reaches your own mailboxes, and re-enabling SMTP AUTH for just the scanner mailbox works only until Microsoft's final removal date (how, timeline).
Host Name/IPyourdomain-com.mail.protection.outlook.com
Port25
SMTP AuthenticationNone (no login)
Connection EncryptionSTARTTLS (if supported)
From Field (Default From)scanner@yourdomain.com (any address in your domain)
Exchange connectorConnection from: Your organization's email server; authenticated by your static public IP

Check your domain's SPF and DMARC

A relay sends from your office IP, so it must be in your SPF record.

Several devices to move? The Microsoft 365 SMTP Fix Kit puts every printer, scanner, app and script on one printable guide: decision table, relay connector set-up, per-device steps, a sender worksheet and a checklist.

Get the kit ($19)

Sources

Other devices and apps