Printer troubleshooting technician providing live chat help

Joe B.

Reviewed for technical accuracy

Specialities: Microsoft 365 / Office 365 mail flow, Exchange Online, scan-to-email on MFPs, app-only OAuth, shared mailbox permissions

Scan to shared O365 mailbox fails — scan to email, app-only authentication, shared mailbox permissions & SMTP AUTH

Technician avatar Technician
Hey! Let’s work out why **scan to a shared Office 365 mailbox is failing** and whether **app-only auth** or **permissions** are the culprit.
Quick questions first:
• What brand/model is the multifunction printer (MFP) or scanner?
• Are you using **SMTP AUTH to smtp.office365.com** from the device, or some **middleware/app registration** (Graph app-only, service account, etc.)?
• When you scan to the **shared mailbox address**, do you get a **bounce/NDR** like 5.7.60 Client does not have permissions to send as this sender, or does the job succeed on the device but nothing shows up in the shared inbox?
Customer
We’ve got a couple of Ricoh and HP MFPs. They’re configured with **smtp.office365.com:587 TLS** using a dedicated service account. Scanning to user mailboxes works, but scans to a **shared mailbox in Microsoft 365** fail. Sometimes we get 5.7.x errors, sometimes it just disappears. We were told to move to **app-only authentication**, but that made it worse.
Technician avatar Technician
Got it — that’s a very common **scan to shared mailbox** problem.
In **Exchange Online**, the scanner usually authenticates with **SMTP AUTH client submission** using one licensed mailbox (your service account) and then sends mail **from** or **to** other mailboxes:
• If you try to send as the **shared mailbox address** but authenticate as the service account, you need proper **Send As / Send on Behalf** permissions, or you’ll see **5.7.60 “client does not have permissions to send as this sender”**.
• If you’re trying to use **app-only authentication / Microsoft Graph** directly from the MFP, most devices don’t fully support **OAuth2 client credentials** yet, and app-only access to **shared mailboxes** needs the right **Mail.Send / Mail.ReadWrite** application permissions plus an **application access policy**.
Plan: 1) Stabilise **SMTP AUTH scan-to-email** first. 2) Ensure the service account has **Send As or Full Access** on the shared mailbox. 3) If you keep app-only, scope the app with proper **Graph application permissions** and restrict it to the shared mailbox via **application access policies**.
Customer
Right now the MFP signs in with a licensed user account and uses the shared mailbox address in the From field. That’s when we see 5.7.60. If we change the From to the user’s address, mail delivers but users don’t like that it’s not “from” the shared mailbox. How do we fix the permissions cleanly?
Technician avatar Technician
Perfect, that error lines up with **Send As permissions** missing for the shared mailbox.
Step 1 — Give the scanning account permissions on the shared mailbox
1) In the **Microsoft 365 admin center**, open the **shared mailbox** (e.g. scans@contoso.com).
2) Under Mailbox delegation, grant your **scanner/service account** at least **Send As** (so messages can be stamped as the shared mailbox) and optionally **Full Access** if you want it to read or manage items.
3) Wait for permissions to replicate (can take a little while in Exchange Online).
4) On the **MFP’s SMTP settings**, keep the login as the service account but set **From address** to the shared mailbox. Test a scan — if permissions are correct, the mail should land in the shared mailbox with the right sender, no more 5.7.60.
Customer
That makes sense. But our security team wants us to stop using username/password on the device and move toward **modern auth / app-only**. The newer HP supposedly supports OAuth for Office 365. Can we use an **app registration** to send scans into a shared mailbox instead?
Technician avatar Technician
You can, but there are a few **gotchas with app-only auth and shared mailboxes**.
Step 2 — Understand app-only authentication for scan-to-email
• For **SMTP AUTH with OAuth**, you register an app in **Microsoft Entra ID**, grant **SMTP.Send** (or related) permissions, then the device uses **OAuth2** to authenticate to smtp.office365.com instead of a password.
• For **Graph API app-only**, an app with **Mail.Send / Mail.ReadWrite** application permissions can send messages or drop items straight into folders in a **shared mailbox**.
• Out of the box, app-only permissions often give access to all mailboxes, so you should lock it down using an **application access policy** so the app can only send to or impersonate specific mailboxes (e.g. just the scanning shared mailbox).
Your HP firmware needs explicit support for **OAuth with Microsoft 365**; otherwise, app-only is better handled by a small relay service (on-prem or in Azure) that talks Graph/SMTP OAuth and the MFP just sends locally.
Customer
We tried an app registration with Mail.Send application permission. It authenticates, but mail still doesn’t show up in the shared mailbox. No NDR. Could this be a permission scope issue with Graph or the app access policy?
Technician avatar Technician
Very likely. With **Graph app-only** or **Mail.Send** application permissions, you must be intentional about **which mailbox** the app can touch.
Step 3 — Scope the app to the shared mailbox
• In Entra ID, make sure the app has the right **Graph application permissions**: typically **Mail.Send** if it only needs to send, or **Mail.ReadWrite** if it also needs to move messages into folders.
• In **Exchange Online PowerShell**, create an **application access policy** that allows this app to access just the **shared scan mailbox** (or a group that contains it). This avoids over-privileged access while ensuring scan-to-shared mailbox works.
• If you’re using **SMTP AUTH with OAuth**, confirm that **SMTP AUTH is enabled** for the mailbox or the organization and that the device is actually using OAuth tokens, not silently falling back to disabled basic auth.
After you tighten the scope, test again: the app-only scan should be allowed to submit mail and deliver to the shared mailbox without getting silently dropped.
Customer
Another thing: some scans arrive but land in the **service account’s mailbox**, not the shared one, even though the To address is the shared mailbox. Users don’t see them because nobody checks that account. Is that a configuration thing on the MFP?
Technician avatar Technician
Yes, that’s typical of **scan-to-email mis-addressing** rather than permissions.
Step 4 — Make sure scans actually target the shared mailbox
• On the MFP address book, verify that the **destination email** is the shared mailbox address (for example, invoices@contoso.com), not the service account’s mailbox.
• Some devices have a **“store in sender’s mailbox”** or “send a copy to myself” option. Turn that off, or you’ll see scans landing in the login user’s mailbox instead of the shared inbox.
• If you use an **app-only relay service**, confirm it explicitly writes messages into the **shared mailbox’s Inbox** (or a specific folder) using Graph or EWS, not the app’s own mailbox.
Once the **To** and **folder target** are right, you’ll see the scans consistently appear in the shared mailbox instead of hiding in the service account.
Customer
Good point. Last question: do shared mailboxes need a license for this? We’ve heard mixed answers about licensing when MFPs send to or send as a shared mailbox in Office 365.
Technician avatar Technician
Great question — **licenses** can be confusing here.
• A standard **shared mailbox in Exchange Online** usually doesn’t need its own license, as long as users access it via delegated permissions and it stays within the size/feature limits.
• The **account you authenticate with** (service account or user) does need a license if it has a mailbox and uses **SMTP AUTH**, **Outlook**, or **Graph/IMAP** to send mail.
• If you convert that account to a shared mailbox and still sign in directly with it (not recommended), you may violate the licensing terms. Better pattern: licensed **service account** + unlicensed **shared mailbox**, with **Send As** permissions granted to the service account.
So for **scan-to-email into a shared mailbox**, keep one properly licensed mail-enabled account for auth, and treat the shared mailbox as a target or “From” identity controlled by permissions.
Customer
Understood. If we wanted the most future-proof setup, what would you recommend? Stick with SMTP AUTH or build something around Graph app-only for scanning into shared mailboxes?
Technician avatar Technician
For most organisations today, I’d do a mix:
• Short-term: stabilise **SMTP AUTH client submission** with a **licensed service account**, **Send As** rights on the shared mailbox, and **TLS on port 587**. That’s the configuration Microsoft documents for **MFP scan-to-email with Microsoft 365**.
• Medium-term: introduce a small **relay/service** that uses **Graph app-only** with tightly scoped **Mail.Send / Mail.ReadWrite** and **application access policies** so it can deliver directly into one or more **shared mailboxes** without storing user passwords on the devices.
• Over time, move more devices to talk to this relay using simple SMTP while the relay handles **modern authentication, app-only tokens, and permission scoping**.
That gives you reliable **scan to shared Office 365 mailbox**, aligns with **modern authentication**, and keeps your Microsoft 365 security team happy. If you want, we can map out your exact config live — open the chat and I’ll walk through it with you.
Customer
Thanks, that clears it up. We’ll start with Send As on the shared mailbox and then plan a Graph-based relay. Appreciate the detailed explanation.
Technician avatar Technician
Summary: When **scan to a shared Office 365 mailbox fails**, it’s almost always one of three things: incorrect **SMTP AUTH / TLS settings**, missing **Send As / Full Access** on the shared mailbox, or mis-scoped **app-only permissions** in Microsoft Graph. Use a **licensed service account** for authentication, grant it the right permissions on the shared mailbox, and, if you go app-only, restrict the Graph app with **application access policies** so it can safely deliver scans into that shared inbox. Need help decoding your NDRs or Graph permissions? Open the chat.

Quick answer: the accepted fix

Accepted fix when scan to a shared Office 365 mailbox fails: authenticate the MFP with a **licensed service account** using **SMTP AUTH to smtp.office365.com:587 with TLS**, grant that account **Send As or Full Access** on the shared mailbox, and make sure the device sends from the shared address only after permissions are in place. For **app-only authentication**, give the Graph app **Mail.Send / Mail.ReadWrite** application permissions and scope it to the shared mailbox via an **application access policy** so messages are delivered and not silently dropped.

Why scan to shared O365 mailbox fails (SMTP AUTH, shared mailbox permissions, app-only auth)

Most **scan-to-email to shared mailbox** issues come down to how **Exchange Online** and **Microsoft 365** handle authentication and permissions. When you use **SMTP client submission** from a printer or scanner, the device authenticates as one mailbox but may try to send **as** a different address (the shared mailbox). Without **Send As** or **Send on Behalf** rights, Exchange returns **5.7.60 permission errors** or silently rejects the message. If you switch to **modern authentication / OAuth2** for SMTP or **app-only Graph**, the app must have the right **application permissions** and be restricted to specific mailboxes using **application access policies**, otherwise it might not be able to send to or impersonate the shared mailbox at all.

How to verify scan-to-email and shared mailbox permissions are working

To confirm that **scan to shared Office 365 mailbox** is configured correctly, send a test scan and then check both the **device status** and **Exchange Online message trace**. The device should show a successful SMTP submission, not a generic failure. In the Microsoft 365 admin center, use **message trace** to see whether the item was accepted, routed to the **shared mailbox**, or blocked with a **5.7.x permissions error**. If you use **app-only authentication via Microsoft Graph**, test the app separately by sending a basic message to the shared mailbox or writing a test item into its Inbox. When both SMTP/Graph calls succeed and the shared mailbox shows the message in the correct folder, you’ve validated that **app-only auth, permissions, and mailbox routing** are all aligned.

Scan to shared mailbox — quick troubleshooting tips

Most “scan to shared O365 mailbox fails” cases are misconfigured **SMTP AUTH**, missing **Send As** permissions, or incomplete **app-only permissions**.

Quick path: verify the **MFP SMTP settings** (smtp.office365.com, port 587, TLS), authenticate with a **licensed Microsoft 365 mailbox**, and grant that account **Send As** on the shared mailbox. Make sure the device’s address book points to the **shared mailbox email**, not the service account. If you move to **modern authentication** with OAuth2 or **Graph app-only**, configure the necessary **Mail.Send / Mail.ReadWrite** permissions and lock them to specific mailboxes using **application access policies** so the app can safely deliver scans into shared mailboxes without over-privileged access.

Disclaimer: This information is AI-generated and intended for general guidance only. For advice specific to your environment, please consult a verified expert on Whizz-Tech before making decisions.

Getting Started Is Easy

Ask for help, 24/7

Members enjoy round-the-clock access to 12,000+ verified Experts, including tech support, network engineers, Microsoft 365 admins, mechanics, vets, and more.

Expert will respond in minutes

We match you with an Expert who specialises in your situation — from **scan-to-email issues** and **shared mailboxes** to everyday printer problems.

Save time & money

No scheduling hassles or expensive consults. Membership can save you significant time and money each month by fixing **Microsoft 365 scan-to-email** issues quickly.

FAQ

Why does scan to a shared Office 365 mailbox fail while scan to users works?

When scan to a **shared mailbox** fails but scan to individual users works, it usually means the MFP authenticates with one mailbox but tries to send **as** the shared mailbox without **Send As / Send on Behalf** rights. Exchange Online then returns **5.7.x permission errors** or quietly rejects the message. Fixing **SMTP AUTH settings** and granting the service account **Send As** on the shared mailbox typically resolves it.

Do I need a license for the shared mailbox used for scanning?

In most cases, the **shared mailbox itself doesn’t need a license** as long as it stays within size limits and is accessed via delegated permissions. The **account you authenticate the MFP with** (service account or user) does need a Microsoft 365 license, because it has a mailbox and uses **SMTP AUTH / Graph / Outlook** to send or read mail.

Can I use app-only authentication (Graph) for scan to shared mailbox?

Yes, but you must configure **Graph application permissions** like **Mail.Send / Mail.ReadWrite**, grant admin consent, and then restrict the app to specific mailboxes using **application access policies**. Many MFPs can’t talk Graph directly, so you often introduce a small relay service that handles **OAuth2 client credentials** and delivers scans into the shared mailbox on their behalf.

What SMTP settings should I use for scan to email with Microsoft 365?

For **SMTP client submission**, use smtp.office365.com on **port 587 with STARTTLS**, authenticate with a licensed mailbox, and enable **SMTP AUTH** for that account. The device should send from an address that has permission to send as the desired mailbox (user or shared). This is the configuration Microsoft recommends for **printers, scanners, and LOB apps** sending mail through Microsoft 365.

Sources

Matt Verified Icon
Matt ● replies in < 1 min
Technician Expert
⭐⭐⭐⭐⭐ Trusted by 27,000+ customers
Avatar
Alex · Expert's Assistant
5 Tech Support Specialists are online right now.