How to Set Up an SMTP Relay for Your Copier with Office 365 Authentication and Conditional Access Policies

Modern office copiers often need to send scanned documents via email. Using Office 365 as your SMTP relay ensures secure and reliable email delivery. However, setting this up involves multiple steps, including DNS configuration, Office 365 settings, and copier configuration—especially considering limitations like character count restrictions on some devices.

• Office 365 Account with administrative privileges
• Static Public IP Address of your office network
• Access to DNS Management for your domain
• Copier Device (e.g., Canon) that supports SMTP authentication
• Understanding of Conditional Access Policies in Azure AD

Sender Policy Framework (SPF) records help prevent email spoofing by specifying which IP addresses are authorized to send emails on behalf of your domain.

1.1 Locate Your SPF Record

Access your DNS management console and locate the existing SPF record for your domain. It usually looks like this:

v=spf1 include:spf.protection.outlook.com -all

1.2 Add Your Office IP Address

Modify the SPF record to include your office's public IP address:

v=spf1 ip4:Your.Office.IP.Address include:spf.protection.outlook.com -all

Replace Your.Office.IP.Address with your actual static IP.

1.3 Save the Changes

Update the SPF record and save the changes. DNS propagation may take up to 48 hours, but it usually updates within a few hours.

To allow your copier to send emails through Office 365, you need to set up a connector in Exchange Online.

2.1 Access Exchange Admin Center

• Log in to the Microsoft 365 Admin Center.
• Navigate to Admin Centers > Exchange.

2.2 Create a New Connector

• Go to Mail Flow > Connectors.
• Click on + Add a connector.

2.3 Configure the Connector Settings

• From: Your organization's email server
• To: Office 365
• Click Next.

2.4 Set Up Authentication

• How do you want to identify the sending server?
  • Choose By verifying that the IP address of the sending server matches one of these IP addresses.
  • Enter your office's static public IP address.

2.5 Review and Create

• Review the settings.
• Click Create Connector.

Conditional Access Policies add an extra layer of security by controlling how and when your copier can access Office 365 services.

3.1 Access Azure AD Conditional Access

• Go to the Azure Portal.
• Navigate to Azure Active Directory > Security > Conditional Access.

3.2 Create a New Policy

• Click on + New policy.
• Name your policy (e.g., "Copier SMTP Relay Access").

3.3 Assignments

• Users and groups: Select the service account or group associated with the copier.
• Cloud apps or actions: Select Office 365 Exchange Online.

3.4 Conditions

• Locations: Include your office's public IP address.

3.5 Access Controls

• Grant: Select Grant access.
• Enable Require multi-factor authentication if supported by your copier (most likely not, so you may skip this).

3.6 Enable the Policy

• Set Enable policy to On.
• Click Create.

Now that the backend is set up, configure your copier to use the SMTP relay.

4.1 SMTP Server Settings

• SMTP Server Address: Use your Office 365 MX record.
  • Find it in the Microsoft 365 Admin Center under Domains.
  • It typically looks like yourdomain-com.mail.protection.outlook.com.

4.2 SMTP Port and Encryption

• Port: 25 (recommended for SMTP relay)
• Encryption: Select STARTTLS or TLS if available.

4.3 Authentication Settings

• Authentication: Choose None or Anonymous.
• Note: Since we've set up IP address authentication, credentials are not required.

4.4 Addressing Copier Limitations

Canon's 48-Character Limit

Some Canon copiers have a 48-character limit for SMTP server addresses. If your MX record exceeds this limit:

• Solution: Use the IP address of the MX record.
  • Ping your MX record domain to obtain the IP address.
  • Enter the IP address in the SMTP server field.
• Important: When using an IP address, some devices may require square brackets, e.g., .

4.5 Sender Email Address

• Set a default From email address.
• Ensure it uses your domain, e.g., [email protected].

4.6 Save and Test

• Save the settings.
• Perform a test scan to email to verify functionality.

• Authentication Errors: Ensure that the connector in Office 365 is correctly set up to accept emails from your IP.
• Email Not Delivered: Check the SPF record and ensure it includes your office IP.
• Connection Timeouts: Verify that your firewall allows outbound SMTP traffic on port 25.
• Character Limit Issues: If unable to shorten the SMTP server address, consider updating the copier's firmware if possible.

Setting up an SMTP relay for your copier with Office 365 enhances your organization's ability to send emails securely. By carefully configuring DNS records, Office 365 connectors, conditional access policies, and copier settings—while accounting for device limitations—you can ensure seamless operation.

Remember: Always keep security in mind. Regularly update passwords and monitor access logs to maintain a secure environment.