530 5.7.57 Client not authenticated to send mail: how to fix it

Applies to: Microsoft 365 (Exchange Online) mailboxes used by printers, scanners, websites, scripts and line-of-business apps. You need Microsoft 365 admin rights for steps 3 and 4.

What 5.7.57 means

Apps and devices that send email through Microsoft 365 with a username and password use SMTP AUTH (client submission). The 5.7.57 error says the server didn’t accept the sign-in, so it refuses to send. You’ll often see it in a printer’s scan-to-email log, a website’s mail plugin, or a script’s error output, sometimes next to 535 5.7.3 Authentication unsuccessful.

The usual causes are wrong server settings, no or wrong credentials, SMTP AUTH being turned off for the mailbox or the whole organization, or a security policy that blocks this older sign-in method.

Step 1: Check the SMTP settings

Microsoft’s settings for client submission are:

Setting	Value
Server	smtp.office365.com (use the name, not an IP address)
Port	587 (recommended) or 25
Encryption	TLS / STARTTLS on (TLS 1.2 or 1.3). Port 465 (SSL) isn’t supported.
Authentication	On, with the mailbox’s full email address and password
From address	The same mailbox you sign in with (or one it has Send As permission for)

On printers, the options are often called SMTP authentication, Use SSL/TLS or STARTTLS. If the device only offers SSL on port 465 or can’t do TLS 1.2, it can’t use this method; skip to the alternatives below or update its firmware.

Step 2: Check the username and password

• Use the full email address as the username, not just the name before the @.
• Sign in to outlook.office.com with the same details to confirm they work and the account isn’t locked or asking for a password change.
• Make sure the account has a Microsoft 365 licence with an Exchange Online mailbox. A shared mailbox has no password of its own, so devices should sign in as a licensed mailbox instead.
• If you changed the password recently, update it on the device or in the app too.

Step 3: Turn on SMTP AUTH for the mailbox

SMTP AUTH is off in many organizations. To turn it on for one mailbox in the Microsoft 365 admin center:

1. Go to Users > Active users and select the user.
2. Open the Mail tab and select Manage email apps.
3. Tick Authenticated SMTP and select Save changes.

Or use Exchange Online PowerShell:

Set-CASMailbox -Identity [email protected] -SmtpClientAuthenticationDisabled $false
Get-CASMailbox -Identity [email protected] | Format-List SmtpClientAuthenticationDisabled

Replace the address with your own. The mailbox setting overrides the organization-wide one, which you can check with Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled. Changes can take a while to apply, so test again after a short wait.

Step 4: Check Security defaults, MFA and Conditional Access

SMTP AUTH uses a plain username and password, so modern security settings often block it even when it’s turned on:

• Security defaults: Microsoft says SMTP AUTH is disabled while Security defaults is on in Microsoft Entra ID. You’d have to turn Security defaults off and protect accounts with Conditional Access instead, which is a decision for whoever manages your tenant’s security.
• Multifactor authentication: a device can’t answer an MFA prompt. Microsoft’s troubleshooting suggests turning off MFA for the mailbox the device uses. If you do, use a dedicated mailbox for the device only, with a long, unique password.
• Conditional Access: a policy that blocks legacy authentication also blocks SMTP AUTH. An admin can exclude the dedicated device mailbox, if your security policy allows it.

Because each of these weakens protection, many organizations prefer the options in the next section.

Better options for printers and apps

Microsoft has announced that Basic authentication for SMTP AUTH will be retired in Exchange Online. The date has been pushed back, so check Microsoft’s announcement for the current timeline, but plan to move away from it:

• SMTP relay with a connector: the device sends to your domain’s MX endpoint (for example contoso-com.mail.protection.outlook.com) on port 25, and a connector identifies it by certificate or by your office’s static IP address. No mailbox password is stored on the device.
• Direct send: the same MX endpoint on port 25 with no sign-in, but it can only deliver to mailboxes in your own organization. Fine for scan-to-email to staff.
• OAuth: apps and scripts that support modern authentication (OAuth 2.0) can keep using client submission without a stored password. Many website mail plugins and newer printers offer it.
• A dedicated email service: for high-volume or website mail, Microsoft suggests services such as Azure Communication Services Email.

If you’re setting up scan-to-email on an HP printer, see our OfficeJet Pro 8600 driver guide for installing the full software first.

Related guides

• How to add a shared mailbox in Outlook
• Outlook tips to work faster
• HP OfficeJet Pro 8600 driver: download and install

Official sources: for more detail, see these Microsoft pages:

• Microsoft Learn: Enable or disable SMTP AUTH in Exchange Online
• Microsoft Learn: How to set up a device or application to send email using Microsoft 365
• Microsoft Learn: Fix issues with printers, scanners and apps that send email using Microsoft 365

Frequently asked questions

Why did 5.7.57 start suddenly?

Usually because something changed: a password was reset, MFA or Security defaults was turned on, a Conditional Access policy was added, or SMTP AUTH was turned off for the organization.

Can I use port 465?

No. Microsoft 365 client submission supports port 587 (recommended) or 25 with STARTTLS. If your device only supports SSL on 465, use SMTP relay or direct send instead.

Does a Gmail or Outlook.com account give the same error?

This exact message comes from Microsoft 365 (Exchange Online). Personal Outlook.com accounts use different server settings and rules, so check Microsoft’s settings for Outlook.com instead.

Is it safe to turn off MFA for the scanner account?

It’s a risk. Only do it for a dedicated, licensed mailbox used by that device, with a long unique password, and consider SMTP relay so no password is needed at all.