Why have our scans suddenly stopped arriving?

Often because the printer signs in with only a username and password and Microsoft is switching that method off or phasing it out. An expired or changed password on the sending account is another common cause.

Can the printer send mail without a password?

Yes. With direct send to colleagues inside your organisation, or with a connector in Exchange Online that accepts mail from your office’s fixed internet address. Then there is no password on the device.

Does a sending account for the printer need a licence?

Signing in with an account needs a licensed mailbox. Direct send and a relay through a connector do not. Floor ICT checks in advance what is cheapest and safest for your situation.

Is scanning to OneDrive or SharePoint better than scanning to email?

For internal scans it often is: the scan lands in the right place with the permissions you already set up, and no attachment travels through mailboxes. Whether your device supports it depends on the make and model.

Scan to email in Microsoft 365: how an SME should let the printer send mail safely

Almost every office has a multifunction printer that sends scans by email. It was usually set up once by the supplier, with a user account and a password nobody has touched since. Until scans suddenly stop arriving, or it turns out that the same account can be used to send mail on behalf of your company.

Why scan to email suddenly needs attention

Scan to email is so ordinary that nobody thinks about it. Yet behind it sits an account with a password stored on the device, often without multi-factor authentication and without anyone knowing who created it. If that password leaks, someone outside can send mail from a real address on your domain. For phishing your customers, that is ideal.

On top of that, Microsoft is phasing out support for signing in with only a username and password when sending mail, and that method is already switched off by default in many environments. Older printers that do not support modern sign-in then stop sending mail overnight. Making a deliberate choice now prevents an office full of scans that never arrive.

The three methods side by side

signing in with an account (SMTP AUTH): the printer signs in to Microsoft 365 with an account and can mail anyone, inside and outside the company; this needs a licensed mailbox and a device that supports modern sign-in;
direct delivery (direct send): the printer delivers mail without signing in to the mail server of your own domain; this only works for colleagues inside your organisation, not for external addresses;
relaying through a connector (SMTP relay): you set up Exchange Online to accept mail from your office’s fixed internet address; the printer then sends without a password, also to external addresses, but only from that location.

A fourth route is not to send mail at all: many modern multifunction devices can scan straight to OneDrive or SharePoint through an app from the manufacturer. The scan then lands in the right place straight away, with the permissions you have already set up there.

Which method fits which situation

If employees mostly scan to themselves, scanning to OneDrive or SharePoint or direct send is the simplest option, and there is no password on the device. With direct send, be careful: attackers abuse this route to send mail that appears to come from a colleague. Microsoft now offers a setting to reject direct send; before switching it on, you need to know which devices still depend on it.

If scans or notifications need to reach customers, suppliers or your accountant, choose a relay through a connector when you have a fixed internet address. Without a fixed address, or with devices at several locations, use a dedicated sending account, and only if the device supports modern sign-in. If an old device cannot, replacing it or routing it through the connector is usually cheaper than an exception that keeps your security open.

What to arrange in any case

no personal account on the printer: never use an employee’s or an administrator’s login; create a separate account that can only send;
keep exceptions small: if the sending account has to be excluded from conditional access or multi-factor authentication, limit that to that one account and, where possible, to your office address;
update SPF: add the relay’s fixed internet address to your SPF record so recipients do not flag your scans as spoofed;
lock down the device: change the default password of the admin panel, keep the firmware up to date and preferably put printers on a separate network;
watch sign-ins: monitor the sending account’s sign-ins through risky sign-ins; a printer signing in from abroad is a red flag.

A common mistake

The quickest fix when scans stop arriving is to switch basic authentication or the legacy sign-in method back on for the whole organisation. That also opens the door to attackers who use exactly that method to guess passwords. Read our article on legacy authentication to see why you are better off leaving it off and solving the problem per device.

What Floor ICT sets up

Floor ICT, as a managed service provider, takes stock of which printers, scanners and applications send mail in your organisation and with which account. We choose the safest working method per device, set up connectors or sending accounts, update SPF and clean up old accounts with stored passwords. You decide which devices may send to external addresses; we make sure it works and stays secure.