Hello,
The fix is to stop using authentication entirely and move the device to Microsoft 365 SMTP relay with an inbound connector that trusts your public static IP.
This method works even when
SMTP AUTHis disabled by security defaults or blocked per mailbox, and it avoids POP or IMAP settings which are not used for sending.
Set it up in two parts.
First, in the Exchange admin center go to Mail flow > Connectors, add a new connector from Your organization's email server to Office 365, choose to identify mail by IP, and add the static public IP that the copier uses to reach the internet. Save the connector. If you already run hybrid and have an inbound connector for your on‑premises mail flow, you can keep using that and just ensure the copier egresses through the allowed IP. Microsoft requires a static, non‑shared IP for IP‑based relay and port 25 must be open outbound.
Second, point the copier at your tenant MX endpoint and do not enter credentials. In the copier SMTP settings set the server to your domain's MX host, for example contoso-com.mail.protection.outlook.com, use port 25, enable TLS or StartTLS if the device supports it, leave username and password blank, and set the From address to any sender in one of your accepted domains, for example ******@contoso.com.
If you prefer to keep client submission on port
587, the device must supportTLS 1.2or later andSMTP AUTHmust be explicitly enabled on the mailbox or tenant, which is often what blocks authentication on modern tenants. Given you are already hitting auth failures, moving the copier to SMTP relay is typically faster and more robust.
Tell me the public IP the copier uses and whether your ISP allows outbound port 25, and I will map your exact connector settings and verify the MX host for your domain.