Forum Discussion

barooder's avatar
barooder
Copper Contributor
Sep 23, 2026

Need help with scan-to-email function on printer

Exchange Online SMTP AUTH returns 535 despite SMTP AUTH being enabled

I'm troubleshooting SMTP AUTH for a Ricoh MP C2011, but I can reproduce the same authentication failure independently using PowerShell.

Exchange Online settings:

SmtpClientAuthenticationDisabled (tenant): False SmtpClientAuthenticationDisabled (mailbox): False AllowLegacyTLSClients: True AuthenticationPolicy: None DefaultAuthenticationPolicy: None Security Defaults: Disabled

The test mailbox has a Microsoft 365 Business Basic license. MFA was also disabled during testing.

Connectivity is working:

  • smtp.office365.com:587 is reachable
  • STARTTLS succeeds with TLS 1.2
  • After STARTTLS, the server advertises:

250-AUTH LOGIN XOAUTH2

I then performed a raw SMTP AUTH LOGIN test. The server accepts the authentication sequence but rejects the credentials:

334 VXNlcm5hbWU6 334 UGFzc3dvcmQ6 535 5.7.3 Authentication unsuccessful

Send-MailMessage produces the same result:

5.7.57 Client not authenticated to send mail 535 5.7.3 Authentication unsuccessful

I have tested both the normal mailbox password and an app password, with the same result.

The Ricoh reports:

SMTPC: username or password wasn't correct. [535]

At this point, I'm trying to determine why Exchange Online is rejecting AUTH LOGIN when SMTP AUTH is enabled at both the organization and mailbox levels.

Could there be another Exchange Online or Entra setting blocking Basic SMTP authentication that isn't reflected by SmtpClientAuthenticationDisabled?

Login

1 Reply

  • maskwill's avatar
    maskwill
    Brass Contributor
    Sep 25, 2026

    Yes. SmtpClientAuthenticationDisabled = False only enables SMTP AUTH; it does not necessarily allow Basic AUTH for SMTP.

     

    The key thing to check is the Authentication Policy actually applied to the mailbox. Microsoft documents AllowBasicAuthSmtp separately.

    Run:

     

    Get-User email address removed for privacy reasons | Format-List AuthenticationPolicy

     

    If a policy is returned:

     

    Get-AuthenticationPolicy "PolicyName" |

    Format-List Name,AllowBasicAuthSmtp

     

    You need:

     

    AllowBasicAuthSmtp : True

     

    If there is no mailbox policy, also check the organization's default:

     

    Get-OrganizationConfig |

    Format-List DefaultAuthenticationPolicy

     

    Then inspect that policy's AllowBasicAuthSmtp.

     

    Important in your case

    The fact that the server advertises:

     

    250-AUTH LOGIN XOAUTH2

     

    does not prove that Basic AUTH LOGIN is permitted for the account. Exchange can advertise the mechanism and subsequently reject the authentication attempt. Microsoft specifically notes that an authentication policy blocking Basic SMTP overrides the normal SMTP AUTH mailbox/tenant settings.

    Also, app passwords won't bypass a Basic-Auth block; Microsoft explicitly says blocking Basic authentication also blocks app passwords.

    One other major point: Microsoft has been retiring Basic authentication in Exchange Online, so for a Ricoh that only supports AUTH LOGIN, the long-term solution is likely SMTP relay / direct send / a modern-auth-capable firmware or intermediary, rather than continuing to troubleshoot mailbox-password authentication.