How to Set Up Scan to Email on Your Copier — Without an IT Department
Scan-to-email used to be simple: enter an email address and password, done. Then Microsoft and Google tightened email security — rightly — and broke the simple way. This guide walks through the setup that works now, in plain English, for Microsoft 365, Gmail, and everything else. It also fixes setups that worked for years and suddenly stopped.
Your Copier Is Just Another Email Sender
When your copier emails a scan, it does exactly what Outlook does: it logs into an outgoing mail server (called an SMTP server) with an email address and a credential, and sends a message with the scan attached. Every scan-to-email problem in existence lives in one of three places:
- 01The mail server settings — the server address, port, and encryption type the copier uses to reach your email provider.
- 02The credential — and this is where modern setups fail, because Microsoft and Google no longer accept a plain account password from a copier by default. You'll create a special credential instead (covered below).
- 03The copier's own network settings — it needs working DNS and a gateway to reach the internet at all.
Gather These Four Things First
Ten minutes of prep prevents the start-stop-search-restart cycle that makes this job feel harder than it is.
- 01A dedicated email address for the copier — something like scanner@yourcompany.com. You can use an existing account, but a dedicated one means password changes on personal accounts never break scanning, and everyone recognizes where scans come from. It needs to be a real, licensed mailbox on your email system.
- 02Admin access to your email system — the Microsoft 365 admin center or Google Admin console login. For the Gmail app-password route you only need the scanner account's own login.
- 03The copier's IP address — print it from the copier's own menu under Settings › Reports › Network Configuration (naming varies by brand). You'll use it in a moment to configure everything from a browser instead of the copier's tiny touchscreen.
- 04Fifteen uninterrupted minutes — most of this is done at a computer, not standing at the machine.
Microsoft 365 Setup
Microsoft 365 blocks copiers from signing in with a plain password unless you explicitly allow it for that one mailbox. That's the whole trick: enable "Authenticated SMTP" on the scanner's mailbox, then give the copier the standard server settings.
-
Enable SMTP AUTH for the Scanner Mailbox
Sign in at admin.microsoft.com › Users › Active users › click the scanner account › Mail tab › Manage email apps › check Authenticated SMTP › Save. This permits SMTP sign-in for this one mailbox only — the rest of your organization stays locked down. Allow up to an hour for the change to take effect (it's usually faster).
-
Enter These Settings on the Copier
SMTP server smtp.office365.com Port 587 Encryption STARTTLS (sometimes labeled "TLS") Authentication On — username & password Username scanner@yourcompany.com (the full address) Password The mailbox password From / device email scanner@yourcompany.com (must match the username) The "On the Copier" section below shows where these fields live on your device.
-
If Sign-In Is Still Rejected: Security Defaults
Newer Microsoft 365 tenants ship with Security Defaults enabled, which blocks this style of sign-in entirely regardless of the mailbox setting. If authentication keeps failing after step 1, your tenant likely has Security Defaults or a Conditional Access policy in force. At that point the clean options are Microsoft's Direct Send method (works without a password but can only deliver to your own domain's addresses — fine for many offices where scans only go to staff) or a properly configured connector. Both touch tenant-level settings, and this is the moment where a quick assist from whoever manages your Microsoft 365 — or from us — beats trial and error.
Gmail & Google Workspace Setup
Google no longer accepts a Gmail account's normal password from a copier — that door closed for good. The replacement is an app password: a special 16-character password Google generates for exactly this purpose. Creating one takes three minutes.
-
Turn On 2-Step Verification for the Scanner Account
App passwords only exist on accounts with 2-Step Verification enabled. Sign in to the scanner's Google account, go to myaccount.google.com › Security, and turn on 2-Step Verification (a mobile number or authenticator works). If it's already on, skip ahead.
-
Create an App Password
Still under Security, search the account settings for "App passwords" (Google moves this around; the search box at the top of myaccount.google.com finds it instantly). Create one — name it "Copier" — and Google displays a 16-character password. Copy it immediately; it's shown only once. This is the password the copier will use. The account's real password stays untouched.
-
Enter These Settings on the Copier
SMTP server smtp.gmail.com Port 587 with STARTTLS (or 465 with SSL) Authentication On — username & password Username The full Gmail / Workspace address Password The 16-character app password (no spaces) From / device email The same address
Entering the Settings on the Copier — the Easy Way
Here's the trick most people don't know: you don't have to type any of this on the copier's touchscreen. Every business copier has a hidden web admin page — open a browser on any computer in the office and type the copier's IP address into the address bar.
-
Open the Copier's Web Admin Page
In your browser, go to http://<the copier's IP address> — for example http://192.168.1.47. Log in as admin (default credentials are in the manual or on a label; if we installed your device, we set and documented these). Each brand names this page differently — HP calls it the Embedded Web Server, Canon the Remote UI, Brother Web Based Management — but they all work the same way.
-
Find the Email / SMTP Settings
Look for a section named Network › Email, Scan/Digital Send › Email Setup, Send › E-Mail Settings, or SMTP. Enter the server, port, encryption, username, and password from your provider's section above, plus the device's "from" address. Save.
-
Send the Test
Nearly every admin page has a "Test connection" or "Send test email" button next to the SMTP settings — use it before walking to the copier. A pass here means the hard part is done. Then scan a real page to yourself from the device to confirm end to end.
-
Build the Address Book
In the same admin interface, find Address Book or Contacts and add your staff — typing addresses in a browser beats the touchscreen keyboard forever. Most devices also let you assign favorites or one-touch buttons so a scan to accounting is literally one press.
Scan-to-Email Troubleshooting
Match the failure to the fix — each of these has a distinct signature.
The Credential Is the Problem
Triple-check the username is the full email address and the password has no stray spaces (app passwords are often displayed with spaces — enter them without). On Microsoft 365, confirm Authenticated SMTP is enabled on that mailbox and give it an hour. On Gmail, confirm you're using the app password, not the account password. If all of that is right on a 365 tenant, Security Defaults is likely blocking it — see step 3 of the Microsoft section.
You're on Direct Send
Delivery that works internally but never externally is the signature of Microsoft's Direct Send method, which by design only delivers to your own domain. If external scanning matters, switch to the authenticated SMTP setup (Path A) or have a connector configured.
Spam Filtering, Not the Scanner
Have recipients mark one scan as "not junk," and make sure the copier's from-address is a real mailbox on your own domain rather than an invented one — messages claiming to be from an address that doesn't exist fail authentication checks and get filtered. If external recipients' systems junk your scans, your domain's SPF record may need attention: a quick task for whoever manages your DNS, or for us.
Attachment Size Limit
Email systems cap attachments around 20–25 MB, and a 40-page color scan at 600 DPI sails past that silently. Lower the default resolution to 200–300 DPI, scan in black & white when color isn't needed, or use scan-to-folder for big documents — it has no size ceiling.
The Copier Can't Reach the Internet
The email settings may be perfect while the copier's network settings are not. On its configuration page, verify it has a valid gateway and DNS server (using your router's address for both is a fine default). Also confirm you're not configured for port 25 — most internet providers block it; use 587.
Something Changed Upstream
The copier didn't change — the account did. The usual suspects, in order: the mailbox password was changed (breaks the stored credential — on Gmail, generate a fresh app password), the company migrated email providers (all settings need re-entry), or the provider tightened security policy. Identify what changed on the email side that week and the fix identifies itself.
Or Skip All of This
Every ABT installation includes full setup — print drivers, network configuration, and scan-to-email, tested and working before we leave. And under our service plans, when Microsoft or Google changes the rules again (they will), reconfiguring it is our problem, not your afternoon.