We followed the procedure from and it seems to work pretty well. Some of the older systems make it a challenge to change the SMTP TX port (such as the C250 and C350 systems). We use Canon Image Runner systems of various sizes and configs and this is an option on all of them. It may not be perfect, but it fits the bill for what we're trying to accomplish there. That means that even if the password were to be guessed, the logon still wouldn't succeed outside our network. We also lock it down so that the account can only log on from a given IP address (our network). Through policies, we allow that account to use 'Legacy Auth Apps' which includes SMTP, POP3, IMAP protocols.

We also use Conditional Access policies to lock things down. We have an exception group and the service account that the copier uses goes into that group. It is a blanket rule so all accounts must have MFA turned on. We enable MFA on all accounts via a policy in Azure AD Identity Protection. If you are using Azure AD and have the P2 license, you get some different ways of doing things. If you're using an external MFA provider, then it gets to be challenging but most have a bypass for a given IP address or a similar app password work around. Authenticate using the UPN and the regular password or the app password (if MFA is enabled).

If you have MFA enabled on the account, you can get an app password (assuming that you're using Microsoft's built-in MFA) to bypass the MFA challenge. If your accounts are just in O365 and/or Azure AD without anything other than a straight up O365 E3/5 license, there are a couple of options.

O365 modern authentication