A nonprofit housing organization lost its scan-to-email workflow for several weeks, and every call to its authorized equipment service provider came back the same way. The authentication was working. What failed was the device, and the evidence for it was sitting in the manufacturer’s own release notes.
of partial equipment function before we were brought in
not Microsoft 365, and not a setting anyone had changed
multifactor authentication stayed on throughout
the additional investigation hours were not billed
A commercial-grade multifunction printer and scanner sits at the centre of a small office. When its scan-to-email stops, the work does not stop. The work routes around the machine, slowly.
For several weeks the organization ran that way. Copying and printing worked. The Microsoft 365 scan-to-email integration did not. Staff photographed documents, emailed them from phones, and walked files between desks, which is the sort of workaround that never appears in a budget and costs a great deal anyway.
The organization had called its authorized equipment service provider more than once. Each time the answer came back the same: the fault lay with Microsoft 365.
The fault did not go away.
Each call established what the problem was not.
For a nonprofit this is worse than an inconvenience. It is staff hours drawn away from the community the organization exists to serve, spent instead on moving paper around a system that was bought so the office would not have to. And it is a capital asset sitting in the corner, delivering a fraction of what it was purchased for.
What the organization needed was not another workaround. It was someone willing to own the question until it had an answer.
There were two easy routes available, and we took neither. The first was to accept the diagnosis already on file. The second was to loosen the Microsoft 365 security posture until the scanner stopped complaining — the oldest fix in the trade, and the one that quietly hands an organization a worse problem than the one it started with.
Instead we traced the whole authorization path, end to end.
The device could reach Microsoft 365, complete the OAuth 2.0 exchange and obtain authorization. Scan-to-email then worked. On that evidence alone, the existing diagnosis was already wrong.
Authorization did not fail at the point of sign-in. It failed afterwards, once established. A failure that arrives late points at token handling, not at credentials.
The device was running an older build. Konica Minolta had since published updates addressing OAuth-related compatibility, which had never been applied.
A later firmware release added support for larger Microsoft authentication tokens. That detail turned a plausible hunch into a specific, testable claim worth putting in front of a vendor.
“Update the firmware” is advice anyone can give. It is also what makes a service provider reach for the next ticket, because it arrives without a reason attached.
What moves a vendor is a mechanism: this build, this token behaviour, this published release, this symptom. The difference between the two is the difference between being managed and being answered.
The organization had already been sent back to Microsoft 365 more than once. Asking again in the same terms would have produced the same answer, so we changed what was being asked.
We wrote the service provider a technical escalation setting out the installed firmware build, the observed OAuth behaviour including where in the sequence authorization was lost, and the manufacturer’s published compatibility updates. We asked for one thing: a formal firmware assessment and a remediation path.
The provider confirmed updated firmware was available and scheduled a technician to apply it. Given something specific to check, they checked it. That is worth saying plainly, because the failure here was never incompetence. It was a question that had never been framed in a way anyone could answer.
After the upgrade we verified the installed build, coordinated reauthorization, and tested the scanner past the point at which authorization had previously collapsed.
The skill was not knowing which setting to change. It was knowing when a diagnosis deserves to be challenged, and how to evidence the challenge.
Scan-to-email returned to normal operation and the authorization held. Staff could again send documents straight from the device, and the photograph-and-email routine stopped. The organization estimates the restored workflow runs close to twice as fast as the workaround it replaced.
Two things did not happen, and both matter more than the speed. Multifactor authentication stayed on throughout, so nothing was traded away to make a printer agreeable. And no equipment was replaced, because the equipment was never the problem; the build it was running was.
A critical office workflow returned to normal use after several weeks of partial function.
Assessed across Microsoft 365, device configuration, the OAuth exchange and installed firmware.
Findings formally escalated to the authorized service provider, who then acted on them.
Multifactor authentication remained enabled. Nothing was weakened to make the device cooperate.
Existing commercial equipment returned to productive use rather than being replaced early.
The research, escalation and testing beyond the original scope were not charged.
This engagement took considerably longer than scoped. It needed research, repeated troubleshooting, written documentation, vendor correspondence, coordination and post-remediation testing, most of it outside what had been agreed.
We did not invoice the nonprofit for it. It was not a gesture, and it is not a discount to be raised again at renewal. A nonprofit pays for that hour out of its program budget, which is to say out of the thing it exists to do.
The point of the engagement was a working office, and we had not reached one yet.
What looks like a Microsoft 365 fault turns out to live in device firmware. What looks like hardware starts in software. A recurring disruption needs two vendors in the same conversation, and neither one convenes it.
Every provider involved here answered correctly within its own boundary. The equipment vendor was asked about the equipment and found nothing wrong with the equipment. Microsoft 365 was authenticating, which it was. Each answer was true and the office still could not scan.
When every supplier answers only for its own territory, the client is left holding the gaps between them.
That gap is the work. It needs someone who will carry a problem across a boundary rather than hand it back at one, and who can write the paragraph that makes another vendor move.
Protecting a technology investment is not always a security control. Here it meant a machine doing the job it was bought for, a security posture that stayed where it was, and a replacement cycle that did not start early for no reason.
We did not sell this organization a solution. We made the one it already owned work as intended.
Bring us the one that has been passed back and forth. A thirty-minute conversation is usually enough to work out whose question it is — and that costs nothing.
Redefine LogicWe help small businesses, nonprofits and co-ops grow safely — marketing that brings people in, security that protects what you build.
© 2026 Redefine Logic Media™. All rights reserved.
Redefine Logic Mediaâ„¢ is committed to making this website usable by as many people as possible, regardless of ability or the technology they browse with. We treat accessibility as ongoing work rather than a one-time task.
We aim to meet the Web Content Accessibility Guidelines (WCAG) 2.2 at Level AA. We test with keyboard-only navigation, screen readers and automated tooling, and we fix issues as we find them. We are not claiming full conformance across every page — where we fall short, we want to know.
This site includes an accessibility toolbar that lets you adjust the page to suit how you read and navigate. It changes only how the page is presented in your browser; it does not send your choices anywhere, and it does not replace the underlying accessible markup of the site.
The toolbar can:
This site is built to work with screen readers such as NVDA, JAWS, VoiceOver and TalkBack, and to be fully operable with a keyboard alone. If you use assistive technology and something does not work as expected, that is a bug on our side, not yours — please tell us.
Some third-party content — embedded maps, videos, payment forms and social feeds — is outside our direct control and may not meet the same standard. Where we can, we provide an accessible alternative. Where we cannot, we will help you get the same information another way.
If you hit something on this site you cannot use, please get in touch through the contact details on this site. Tell us the page and what went wrong, and we will respond and work with you on an accessible alternative.
Accessibility toolbar by Redefine Logic Media.