Keep scan-to-email working after Microsoft turns off SMTP basic auth
Printers, scanners and older business apps that send email through smtp.office365.com with a username and password will stop sending. We're building a hosted relay that keeps them working through your own Microsoft 365 mailbox: no static IP, no connector certificate, no server in the office.
Free to join, no payment, no commitment. We'll email you once, when there is something to try.
What is changing
Microsoft is retiring Basic authentication for SMTP client submission (SMTP AUTH) in Exchange Online. According to Microsoft's announced timeline, it is disabled by default for existing tenants at the end of December 2026; tenants created after that can't use it, and Microsoft will announce the final removal date in 2027. Admins can switch it back on until then, but every device that relies on it has to move.
Sources: Microsoft Learn: how to set up a multifunction device or application to send email (updated 5 October 2026) and the Exchange team's retirement timeline.
Why Microsoft's own alternatives often don't fit
| Option | The catch, per Microsoft's documentation |
|---|---|
| SMTP relay connector | Needs a TLS certificate or a static public IP address that isn't shared with another organization. Dynamic IP addresses aren't supported. Can't be used from third-party hosted services. |
| Direct Send | Can't deliver to external recipients, and Microsoft is working on an option to disable it by default. |
| High Volume Email | Sends to internal recipients only. |
| Azure Communication Services Email | Needs an Azure subscription and setup. |
| OAuth on the device | Many older printers and apps can't do it. |
How Spunova Relay will work
1 Point the device at us
The printer or app keeps sending plain SMTP, with its own per-device login, to our relay instead of smtp.office365.com.
2 Your admin approves one mailbox
A Microsoft 365 admin consents to our app once, limited to the one mailbox the devices send from. We never see or store a mailbox password.
3 Mail leaves from your own mailbox
We hand each message to Microsoft through the official Microsoft Graph interface. Recipients see your address, and a copy lands in that mailbox's Sent Items.
Planned: a dashboard with delivery logs and failure alerts, a check of your domain's email authentication (SPF, DKIM, DMARC), and per-device rate limits so the relay can never be used for spam.
Who it's for
Small businesses on Microsoft 365
Scan-to-email on the office printer, invoices or reminders from an older business app.
IT service providers (MSPs)
Many customer tenants with the same problem. A reseller plan with one dashboard is planned.
Copier and printer dealers
Keep your customers' devices working without a site visit for every tenant.
Planned pricing: about €5–9 per Microsoft 365 tenant per month, with bundles for MSPs. Nothing is for sale yet.
Join the waitlist
Questions
Can't we just switch basic auth back on?
Until Microsoft's final removal in 2027, an admin can re-enable it. That buys time, but every device still has to move, and new tenants won't have the option.
Is this an open relay?
No. Every device gets its own login, every tenant is limited to the mailbox its admin approved, and sending is rate-limited.
Where is data processed?
The waitlist is stored in Google Firebase in Frankfurt (EU). For the relay itself we plan EU hosting; details will be published before launch.
When will it be available?
We're deciding based on how many people join. We won't promise a date we can't keep; waitlist members hear first.