For many IT teams, Microsoft 365 is where an old copier first runs into a modern identity problem. Microsoft 365 changes have made copier email configuration more complicated, especially when an older multifunction device cannot perform OAuth itself.
Why this matters
Start by deciding whether the copier can support OAuth natively or needs a relay service that can perform OAuth on its behalf.
Keep the copier configuration simple: SMTP server, port, sender identity, TLS settings, and any device-side authentication that your relay requires.
Keep the copier simple
The copier is usually the hardest component to update and the least pleasant place to troubleshoot identity. Where possible, keep the device-side configuration limited to ordinary SMTP settings and move modern authentication, token refresh, policy, and detailed logging into a service designed to handle them.
Practical points to consider
- Use delegated OAuth permissions that match the mailbox being used instead of giving a copier broad tenant-wide access.
- Test both internal and external recipients, because some Microsoft 365 delivery methods have different limitations.
- Document the mailbox, device, relay endpoint, and ownership so the configuration can be supported later.
What a supportable setup looks like
A good Scan-to-Email design should be understandable months after it is installed. IT should know which device is sending, which cloud connection is being used, which destinations are permitted, and where to look when delivery fails.
That usually means using a dedicated or clearly owned sender identity, encrypted credentials or tokens, modern TLS on the cloud side, useful logs, and a documented reconnect process. It also means avoiding broad permissions simply because they are easier to configure.
Where CM Relay fits
CM Relay is designed as the compatibility and policy layer between copiers or other SMTP devices and modern cloud services. The copier can continue using a familiar SMTP workflow while CM Relay handles OAuth-based delivery, connection health, logging, and policy controls such as sender and destination restrictions.
That approach lets an organization modernize the email path without turning a copier replacement project into the only security option.
Further reading
- https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365
- https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission
- https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online
Next step
If your organization is still relying on old SMTP credentials, inconsistent copier settings, or manual workarounds, start by documenting the current Scan-to-Email path. From there, you can decide which parts need to be modernized without disrupting the user experience.
https://cmrelay.com/features/ or https://cmrelay.com/contact/ to discuss your environment.