Secure Scan to Microsoft 365, Direct from the MFP
Scan directly to OneDrive and send email through Exchange Online with direct OAuth2, badge/PIN authentication and no intermediary scan server or cloud proxy.
Users authenticate in seconds at the MFP and securely access their Microsoft 365 scan workflows. Documents are sent directly from the printer to Microsoft 365, while OneDrive and Exchange Online remain the trusted destinations for storage, delivery and corporate security policies.
No additional scan gateway is required between the MFP and Microsoft 365, helping reduce complexity while keeping the user experience fast and consistent.
Scan to OneDrive
Scan directly to the authenticated user’s OneDrive for Business. Documents go from the MFP to Microsoft 365 without intermediary scan storage or processing.
Email via Exchange Online
Send scans through Microsoft 365 using the authenticated user’s identity. Messages can appear in the user’s Sent Items, benefit from Purview DLP and corporate policy rules.
One Celiveo Screen
A single, consistent MFP screen for scanning to OneDrive or sending by email, fast, simple and easy to use.
From paper to recipient, without the PC in the middle
From paper to recipient — without the PC in the middle
The old workflow
The Celiveo 365 workflow
Security without any middleman
Security without the middleman
Reduce the trust boundary. Keep the scan path between the MFP and Microsoft 365.
Celiveo 365 Architecture
Direct connection between the MFP with Celiveo 365 agent, and Microsoft 365 using OAuth2 and TLS 1.3. No intermediary scan server.
Typical non-Celiveo 365 Architecture
Documents and tokens are processed by third party servers or cloud VM peforming the OAuth2 authentication on the behalf of the user, before documents are forwarded.
Celiveo 365 VS most well-known scan solutions for MFPs
Celiveo 365 vs. intermediary scan architectures
A smaller trust boundary and a faster end-user workflow.
| Capability | Celiveo 365 Secure Scan | Typical architecture of other scan from MFP |
|---|---|---|
| Document path | ✓MFP → Microsoft 365 | MFP → vendor server/VM → Microsoft 365 |
| OAuth architecture | ✓Direct OAuth2 with Microsoft 365 | Token may be relayed or stored on intermediary infrastructure |
| User authentication | ✓Fast badge / PIN authentication | May require repeated web or QR-code authentication |
| OneDrive identity | ✓Authenticated user's OneDrive | May use shared/service identity or vendor workflow |
| Email identity | ✓Authenticated Microsoft 365 user | Often uses printer/service mailbox |
| Sent Items | ✓Can remain in the user's Exchange workflow | Often disconnected from the user mailbox |
| Microsoft 365 security boundary | ✓Document enters OneDrive/Exchange directly | Document may transit third-party infrastructure first |
| MFP experience | ✓One Celiveo screen for OneDrive + email | Multiple apps, portals or workflows may be required |
| Credential exposure | ✓OAuth token encrypted on the MFP | Additional infrastructure may access delegated credentials |
| Desktop step required | ✓No | Frequently required |
Comparison describes common architectural patterns. Exact capabilities vary by vendor and configuration.
Celiveo 365 Cloud Print & Scan : security and usability first
Your Microsoft 365 policies continue to apply
Scans delivered to OneDrive and Exchange Online enter the standard Microsoft 365 governance environment configured by your organization, including applicable DLP, retention, auditing and access policies.
OAuth2 tokens stay where they belong
User OAuth2 tokens are encrypted on the MFP and never leave the printer (except for Entra ID authentication), are not uploaded anywhere for storage. They are used only for direct authentication with Microsoft 365.
Know that your scan arrived
Users can review the result of recent scan operations directly from the MFP.
Send from the authenticated user, not a generic printer mailbox
Traditional scan-to-email often depends on SMTP or a shared printer/service identity. Celiveo 365 uses the authenticated user’s Microsoft 365 identity for the Exchange Online workflow, making the sender meaningful and the sent history traceable and compliant with the corporate policy.
Badge → Scan → Email Sent.
SENT ITEMS: retained by the Microsoft 365 workflow
Built for supported smart MFPs
Celiveo 365 works with a broad range of printers for cloud print management. Advanced Secure Scan capabilities are enabled on smart MFPs that support the Celiveo 365 on-screen agent and the required authentication and security features.
This approach allows Celiveo to deliver the complete direct scan experience directly at the device: fast badge or PIN authentication, a consistent Celiveo user interface, secure Entra ID OAuth2 authentication and direct communication from the MFP to Microsoft 365.
Rather than claiming universal compatibility by reducing functionality or introducing scan gateways, Celiveo validates the MFP platforms that can provide the required level of integration, security and user experience.
This makes it possible to deploy Celiveo 365 across heterogeneous printer fleets while enabling advanced Microsoft 365 Secure Scan on compatible smart MFPs. Support continues to expand as additional printer platforms and models are validated.
Frequently asked questions
Can Celiveo 365 scan directly from an MFP to OneDrive?
Yes. On supported MFPs, authenticated users can scan to their OneDrive for Business using direct OAuth2-based communication with Microsoft 365, without routing the document through any intermediary scan processing or routing server.
Can I send a scanned document directly by email?
Yes. Celiveo 365 can use Microsoft 365 modern authentication for Exchange Online so the scan can be sent as the authenticated user instead of relying on a generic printer mailbox.
Will the scanned email appear in Sent Items?
The Microsoft Exchange Server workflow can save sent messages to the user’s Sent Items, providing traceability similar to sending from Outlook.
Does Microsoft Purview DLP still apply?
Configured Microsoft 365 policies for the target location can continue to evaluate content once it enters OneDrive or Exchange Online. Actual behavior depends on your Microsoft 365 licensing and policy configuration.
Does secure scan work with every printer?
Advanced secure scan requires a compatible smart MFP capable of running the Celiveo 365 on-screen agent. Celiveo supports a much broader device range for print management; check the current compatibility page for scan capability by model.
Where can I find the secure scan documentation?
See the Celiveo 365 Secure Scan documentation for current configuration and workflow details.