MFA for Small Businesses: The Fix Behind Your Broken Scan-to-Email

Here’s a call we get more than you’d think: a business owner tells us the office scanner stopped emailing PDFs. It worked for years. Nobody changed the copier. Then one Monday, scan-to-email quietly died — no error the front desk could make sense of, just documents that never showed up in inboxes. Nine times out of ten, the copier isn’t the problem. Microsoft is.

What actually broke

Microsoft has spent the last couple of years shutting off “basic authentication” — the old method where a device logs into email with just a username and password. That method is exactly how most office copiers and multifunction printers were set up to send scans. When Microsoft 365 flips a tenant to modern authentication (OAuth) or a policy change disables the legacy SMTP path, the copier is still trying the old way, gets refused, and scan-to-email stops. Same thing happens to some line-of-business apps, a few older accounting tools, and any device still using a saved password to reach Exchange.

The reason this matters beyond a broken scanner: the change is happening because a password alone is no longer considered safe enough to protect a mailbox. And if your copier was authenticating with a plain password, that tells you something about how the rest of your accounts are probably protected too.

Why a password by itself stopped being enough

For a small business in the Chicago Southland, the most common way to get hacked in 2026 isn’t some movie-style breach. It’s an employee password that gets phished, guessed, or bought off a list from a completely unrelated site the employee reused it on. Once someone has that password, they log in as your employee — from anywhere in the world — and there is nothing to stop them. No alarm goes off. It just looks like your staff signing in.

Multi-factor authentication (MFA) is the fix, and it’s boring in the best way: after the password, the account asks for a second proof — a tap on a phone app, a code, a hardware key. A stolen password by itself becomes useless. It’s the single highest-impact security control a small business can turn on, and for most Microsoft 365 and Google Workspace plans it costs nothing extra.

The catch nobody warns you about

Turning on MFA the wrong way is how you end up with a dead copier, locked-out staff, and a shared account nobody can get into on a Friday afternoon. The order of operations matters:

• Inventory what logs in with a password first. Copiers and MFPs sending scan-to-email, the accounting software, any old app or backup tool, shared mailboxes, the alarm or camera portals. These break the moment basic auth goes away, and they can’t do a phone tap.
• Move devices to a modern method before you flip the switch. A scanner should use OAuth, a dedicated relay, or an app-specific credential — not the owner’s personal login. We reconfigure the copier’s send settings so the scan-to-email keeps working the day the tenant changes.
• Roll MFA out to people in a planned wave, not all at once. Enroll everyone, give them a heads-up, and keep a break-glass admin account documented so you’re never fully locked out.
• Use an authenticator app or hardware key, not text messages, where you can. Texts are better than nothing but are the weakest option.

Passwords still matter — just not alone

MFA is the seatbelt, but you still want a decent car. A password manager so nobody is reusing the same password across ten sites, a minimum length instead of forced monthly changes (which just produces Password1, Password2…), and a fast way to shut off a departing employee’s access the day they leave. None of this is exotic. It’s the stuff that gets skipped when a small business is busy running the business.

We handle both sides of this

Digitech LLC works with small businesses across the south suburbs — Markham, Tinley Park, Orland Park, Flossmoor, Homewood and the surrounding towns — and because our sister company services copiers and multifunction printers, we’re one of the few local shops that fixes the security side and the “why did my scanner stop emailing” side in the same visit. If your scan-to-email has already broken, or you want MFA turned on without something else breaking in the process, we can map it out and do it cleanly.

Call 708-596-2990 or email mknipper@digitech815.com and we’ll take a look at how your accounts and devices are set up today.