SMTP error 5.7.8 Authentication credentials invalid

What SMTP error 5.7.8 means

The username and password presented were rejected, so nothing was ever submitted. It appears as 535 5.7.8 in the middle of an SMTP session rather than as a bounce, which is why it normally reaches you as a scanner that has quietly stopped emailing PDFs. On Microsoft 365 the credentials are frequently correct and the real answer is that SMTP AUTH is switched off for that mailbox or across the tenant. Basic authentication has been withdrawn for most protocols, so a device that ran untouched for five years can fail on a Tuesday morning with nothing having changed at your end.

Security or policy status
Sent by The server you are authenticating to, replying to the AUTH command
Common

What SMTP error 5.7.8 Authentication credentials invalid actually means

This is a reply to the AUTH command, so the conversation never reached a recipient and no message was accepted. Nobody gets a non-delivery report, because there is no message to report on — the failure exists only in whatever log the sending device keeps. The specification treats it as permanent and expects a client to stop and ask the user for new credentials. Multifunction printers do no such thing; they retry the same stored password every fifteen minutes indefinitely, which is why a failing scanner generates thousands of failed sign-in events before anyone notices. Two neighbouring codes are worth separating from it: 5.7.13 means the password was right and the account is disabled, and 5.7.9 means the password was right and the method used to present it was not acceptable.

This response to the AUTH command indicates that the authentication failed due to invalid or insufficient authentication credentials. In this case, the client SHOULD ask the user to supply new credentials (such as by presenting a password dialog box).
— RFC 4954

How 5.7.8 appears in a bounce

A server reporting this condition sends it alongside a three-digit reply code, and a bounce prints the two together. The registry lists these pairings for this status: 535 5.7.8, 554 5.7.8. Which one you get depends on the point in the conversation at which the server refused.

The leading 5 is the server's verdict rather than part of the code's identity: it marks this as a permanent failure, which means the sending server has given up and returned the message.

What causes SMTP error 5.7.8 on a business phone system

SMTP AUTH disabled on the mailbox or the whole tenantMicrosoft disables SMTP client submission by default on tenants created in recent years, and security defaults switch it off as well. The organisation-level setting overrides the per-mailbox one, so enabling it on the mailbox alone changes nothing if the tenant setting is off.
Multi-factor authentication on an account a device cannot satisfyA printer cannot approve a push notification. Where the account has MFA enforced, the device needs an app password if the tenant still permits them, or the sending method needs to change to something that does not involve that account signing in.
The wrong form of usernameThe sign-in name is the user principal name, which is not always the address on the business card. Where a tenant was built on an onmicrosoft domain and vanity addresses were added later as aliases, the alias will not authenticate even though mail to it arrives perfectly.
A password changed or expired since the device was configuredAfter a reset, and especially after a compromise where every credential is rotated, the old password lives on in the scanner, the CRM, the backup appliance and the door entry system. Each of those then starts failing at whatever interval it retries on.
Conditional Access blocking legacy authenticationA policy that blocks legacy clients catches SMTP AUTH along with everything else. The credentials are accepted and the sign-in is then refused at policy evaluation, and the device only ever sees the generic authentication failure.
The client pointed at the wrong host or portA device aimed at an endpoint that expects certificate-based connector traffic, or at a hostname left over from a previous provider after a migration, will be refused authentication outright. Worth ruling out early because it costs nothing to check.

How to fix SMTP error 5.7.8

Capture the exact username the device is sendingRead it from the device configuration rather than from whoever set it up. Then try that same string in a browser sign-in. If the browser refuses it too, you have a credential problem; if the browser accepts it, you have a policy problem and the rest of these steps apply.
Check the sign-in logs in Entra ID before changing anythingFilter by the user and look at the failure reason recorded there. It is dramatically more specific than the 535 the device receives, and it will tell you outright whether the block was the password, a Conditional Access policy or SMTP AUTH being disabled.
Confirm SMTP AUTH is enabled at both levelsCheck the organisation setting in the Exchange admin centre first, then the mailbox with Get-CASMailbox. Enable it per mailbox with Set-CASMailbox and SmtpClientAuthenticationDisabled set to $false, and leave the tenant default off so this stays an exception rather than a policy.
Ask whether the device should be authenticating at allA scanner that only emails colleagues does not need an account at all. Direct send to your tenant MX record requires no credentials and cannot break when a password changes. For external recipients, a connector restricted to your fixed public IP beats a stored password on a device in a corridor.
Give shared devices their own identityNever configure equipment with a named person's account. When they leave, the account is blocked and the despatch notes stop going out. A dedicated licensed account with a documented purpose costs a few pounds a month and removes an entire category of incident.
Scope any exception as tightly as you canIf an exclusion from a Conditional Access policy is unavoidable, restrict it to the one account and to the office public IP address, put a review date on it, and record it somewhere your successor will find it.

Fixing the underlying problem

This page explains the code. These guides walk through the fix in detail.

Questions about SMTP error 5.7.8

Our scanner stopped emailing and nobody changed anything — how?

Something changed at Microsoft's end. SMTP AUTH and basic authentication have been progressively withdrawn, and tenants get the change applied on a rolling schedule rather than all at once. The device configuration is identical to yesterday; what will accept it is not.

Is this the same thing as a bounce message?

No, and the difference matters when you are hunting for evidence. The rejection happens at sign-in, before any recipient is named, so no non-delivery report exists anywhere. The only trace is in the sending device's log and in your tenant sign-in logs.

Do we need to pay for a licence just so a printer can send email?

Only if it must authenticate. Direct send to your own tenant needs no account and no licence, and covers the common case of a scanner emailing staff. A licensed account is needed when the device sends to external recipients through authenticated submission.

Could repeated failures mean somebody is attacking the account?

Yes, and it is worth ruling out. Look at the source IP addresses on the failed sign-ins. A single familiar address at a regular interval is your misconfigured device. A spread of addresses from several countries is password spraying, and that account needs a reset and a look at its mailbox rules.

Related SMTP status codes

Source. SMTP error 5.7.8 Authentication credentials invalid is defined in RFC 4954 and registered in the IANA SMTP Enhanced Status Codes registry. The causes and fixes above are drawn from our own experience supporting UK business email systems.

All Email delivery & SMTP codes