How to verify whether the OAuth2 flow and consent configuration are correctly applied for multi-function devices in Exchange Online

Question

I have the same issue described in this thread about “What O365 config changes are needed to allow Ricoh printer to send email via Exchange Online OAuth”, and I tried the suggestions there, but it’s still not working for me.

I’ve made sure that Global Admin reviewers are enabled and consent was granted as indicated by the KB article, and I applied the recommended OAuth 2.0 settings. However, the Ricoh MFP still fails to authenticate with Exchange Online: scan-to-email attempts return a 535 authentication error or time out entirely. I double checked firmware compatibility and TLS settings, and confirmed SMTP-AUTH is enabled for the tenant.

How to verify whether the OAuth2 flow and consent configuration are correctly applied for multi-function devices in Exchange Online

Answer 1

Hi Nichols Dylan

Thank you for reaching out to Microsoft Q&A

As far as I know, Ricoh multi-function printers (MFPs) using OAuth 2.0 for scan-to-email with Exchange Online often face 535 authentication errors or timeouts, even when SMTP AUTH is enabled and the device firmware supports OAuth 2.0. The primary cause is that the necessary delegated permissions (SMTP.Send and offline_access) for Ricoh's multi-tenant application haven’t been fully granted via admin consent.

Therefore, if you want to verify whether the OAuth2 flow and consent configuration are correctly applied for multi-function devices in Exchange Online, you can follow the recommend approach below.

Enable Admin Consent Workflow:

• Sign in to Microsoft Entra and go to Identity > Protection > Admin consent settings.
• Set “Users can request admin consent to apps they are unable to consent to” to Yes.
• Add a Global Admin as a reviewer and ensure notifications are enabled.

Confirm SMTP Auth Settings:

• Ensure Authenticated SMTP is enabled in the Microsoft 365 admin center for the mailbox.
• Check the device’s OAuth 2.0 configuration with smtp.office365.com, Port 587, and STARTTLS.
• Run the device code flow and approve consent through the provided URL.

Verify Consent in Entra:

• Go to Entra > Identity > Applications > Enterprise applications.
• Ensure the Ricoh app shows “Granted for <tenant>” for SMTP.Send and offline_access permissions.
• If not granted, repeat the consent process as needed.

Link references:

https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-admin-consent-workflow

https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-device-code

https://kb.gsd.ricoh.com/app/answers/detail/a_id/297331/~/how-to-scan-to-email-with-microsoft-exchange-online-oauth-2.0-authentication

Note: Microsoft is providing this information as a convenience to you. These sites are not controlled by Microsoft, and Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please ensure that you fully understand the risks before using any suggestions from the above link.

Hope my answer will help you, for any further concern, kindly let me know in the comment section.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".     

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.