Exchange Online SMTP for printers and co.

Short answer: run Set-TransportConfig and Set-CASMailbox via Exchange Online PowerShell to re-enable SMTP basic authentication for the tenant and the specific mailbox sending the mail (printer, website, etc.).

Microsoft is moving forward with their goal of completely getting rid of Basic Authentication. But there are always situations in which we cannot avoid it, for example with printers (Scan2Mail) or websites. These usually send the mail via SMTP, which Exchange Online also supports in principle.

Luckily, Microsoft has announced that Basic Authentication for SMTP will continue to work. With newer Microsoft 365 tenants, however, SMTP authentication is deactivated by default.

How do I enable SMTP authentication in Exchange Online?

The following command can be used to activate basic authentication via SMTP for the tenant and one (or more) specific users.

Connect-ExchangeOnline

$user = Read-Host "SMTP User/E-Mail"
Set-TransportConfig -AllowLegacyTLSClients $True
Set-TransportConfig -SmtpClientAuthenticationDisabled $false
Set-CASMailbox -Identity $user -SmtpClientAuthenticationDisabled $false

ℹ️ The Exchange Online PowerShell module is required: https://www.powershellgallery.com/packages/ExchangeOnlineManagement

SMTP configuration on the end device

With the following settings, e-mails can, for example, be sent from a printer or a homepage via SMTP.

SMTP server	smtp.office365.com
Port	587
Encryption	STARTTLS (important)
Log in	Username of the sender
Password	Set password

It is important that the user does not receive an MFA request from the sending device and that no password changes are pending.

FAQ

Does enabling SMTP basic auth affect the whole tenant?
Set-TransportConfig -SmtpClientAuthenticationDisabled $false is tenant-wide, but Set-CASMailbox lets you scope actual sending to specific mailboxes only.

Why does the printer/website still fail to send mail?
The most common cause is MFA being triggered on the sending mailbox, or a pending password change - both block SMTP basic auth even after it’s enabled.

Security note: scope this narrowly

Enabling SMTP basic auth tenant-wide, even if Set-CASMailbox limits who can actually send, still leaves a legacy authentication path open. I always create a dedicated shared mailbox for this purpose (e.g. printer@yourdomain.com) instead of reusing a real user’s mailbox, and exclude that one account from your Conditional Access “block legacy authentication” policy rather than weakening the policy for everyone. That way the exception is contained to a single, low-privilege mailbox that has no other access.

Conditional Access still blocks it even after Set-CASMailbox?
Yes - Exchange transport settings and Conditional Access are independent layers. If a CA policy blocks legacy authentication tenant-wide, it overrides the mailbox-level SMTP setting, so the sending account also needs an explicit exclusion from that policy.