Introduction#

As our organization gradually migrated its document storage to SharePoint Online, we encountered a new challenge.

Traditional multifunction printers (MFPs) typically support:

• Scan to Email
• Scan to SMB
• Scan to FTP

However, most Brother printers—especially entry-level and mid-range models—do not support scanning directly to SharePoint Online.

Continuing to use a traditional SMB shared folder would mean scanned documents remain outside the SharePoint ecosystem, losing the benefits of centralized permission management, version control, and collaboration.

Our objective was straightforward:

Keep the scanning experience unchanged for end users while ensuring every scanned document ultimately ends up in SharePoint.

Solution Architecture#

After evaluating several options, we adopted the following architecture:

1
Brother Scanner
2
        │
3
Scan to FTP
4
        │
5
Windows Server IIS FTP
6
        │
7
Power Automate
8
        │
9
SharePoint Document Library

The entire process is completely transparent to end users.

Users simply select Scan to FTP on the Brother printer.

The system automatically performs the remaining tasks:

1. Save the scanned document to the FTP server.
2. Detect the newly created file.
3. Upload it to the designated SharePoint document library.

No manual intervention is required.

Environment#

Server

• Windows Server 2016 Standard

Printer

• Brother DCP-L2640DW

Automation

• Microsoft Power Automate
• On-premises Data Gateway

Destination

• SharePoint Online

FTP Server

• IIS FTP Server

Installing IIS FTP#

Windows Server does not install the FTP service by default.

Open Server Manager and launch the Add Roles and Features Wizard.

1
Server Manager
2
    ↓
3
Add Roles and Features

Select:

1
Web Server (IIS)

Under Role Services, install the FTP components in addition to the default IIS features:

1
Web Server (IIS)
2
├── Common HTTP Features
3
├── Health and Diagnostics
4
├── Performance
5
├── Security
6
├── ...
7
└── FTP Server
8
    ├── FTP Service
9
    └── FTP Extensibility

These two components serve different purposes:

• FTP Service provides the core FTP functionality.
• FTP Extensibility enables advanced authentication methods and future extensibility, so it is recommended to install it together with the FTP Service.

After the installation completes, a new FTP Sites node will appear in IIS Manager.

Creating an FTP Site#

In this solution, the FTP server is used only as a temporary staging area for scanned documents.

Create a dedicated directory on the server:

1
C:\FTPScan

Then open IIS Manager:

1
Server Manager
2
    ↓
3
Tools
4
    ↓
5
Internet Information Services (IIS) Manager

Expand the server node:

1
PRINTER

Right-click Sites and select:

1
Add FTP Site...

Configure the site using the following settings:

1
Site Name
2
Scanner FTP
3

4
Physical Path
5
C:\FTPScan
6

7
IP Address
8
192.168.x.x
9

10
Port
11
21
12

13
SSL
14
No SSL

NOTE

Why not use FTPS?

The Brother DCP-L2640DW supports standard FTP out of the box, while FTPS (FTP over SSL) compatibility varies depending on the printer model and firmware version.

Since our initial goal was to validate the complete workflow, we chose standard FTP for the first deployment. Because both the FTP server and the printer reside within the internal corporate network, this approach provides a reasonable balance between simplicity and functionality.

If security or compliance requirements change in the future, upgrading to FTPS can be considered without changing the overall architecture.

For authentication, select:

1
Basic Authentication

For authorization:

1
Specified users

Grant access only to the dedicated FTP account used by the scanner.

Creating a Dedicated FTP Account#

Instead of using an administrator account, create a dedicated local user with the minimum permissions required.

Open:

1
Computer Management
2
    ↓
3
Local Users and Groups
4
    ↓
5
Users
6
    ↓
7
New User...

Create the following account:

1
Username
2
scanftp

Using a dedicated account follows the principle of least privilege and simplifies future auditing and maintenance.

Planning the Directory Structure#

Although this deployment initially included only a single printer, it is worth planning a scalable directory structure from the beginning.

For example:

1
C:\FTPScan
2
├── MTL-P73
3
├── MTL-P74
4
├── QC-P01
5
└── HR

Each Brother printer is configured to use its own Store Directory.

For example:

1
Store Directory
2

3
MTL-P73

This allows Power Automate to monitor different folders and automatically upload documents to different SharePoint document libraries without requiring any changes to the printer configuration.

It also makes the solution easy to expand as additional printers are deployed.

Troubleshooting #1: Windows Defender Firewall#

Local FTP testing worked perfectly.

However, client computers were unable to connect to the FTP server.

1
PS C:\Windows\system32> systeminfo | findstr /B /C:"OS Name" /C:"OS Version"
2

3
OS Name:    Microsoft Windows Server 2016 Standard
4
OS Version: 10.0.14393 N/A Build 14393
5

6
PS C:\Windows\system32> Get-Service ftpsvc
7

8
Status     Name     DisplayName
9
------     ----     -----------
10
Running    ftpsvc   Microsoft FTP Service
11

12
PS C:\Windows\system32> Get-WebSite
13

14
Name             ID     State     Physical Path                 Bindings
15
----             --     -----     -------------                 --------
16
Default Web Site 1      Started   %SystemDrive%\inetpub\wwwroot http *:80:
17
Scanner FTP      2      Started   C:\FTPScan                    ftp 192.168.1.129:21:
18

19
PS C:\Windows\system32> netstat -ano | findstr :21
20

21
TCP    0.0.0.0:21                  0.0.0.0:0              LISTENING
22
TCP    [::]:21                     [::]:0                 LISTENING

1
Running    ftpsvc

1
Scanner FTP      Started

1
0.0.0.0:21    LISTENING

1
Test-NetConnection 192.168.1.129 -Port 21

1
WARNING: TCP connect to (192.168.1.129 : 21) failed
2

3
ComputerName     : 192.168.1.129
4
RemoteAddress    : 192.168.1.129
5
RemotePort       : 21
6
SourceAddress    : 192.168.1.191
7
PingSucceeded    : True
8
TcpTestSucceeded : False

1
Get-NetFirewallRule -DisplayGroup "FTP Server" | Select DisplayName, Enabled

1
DisplayName                                 Enabled
2
-----------                                 -------
3
FTP Server (FTP Traffic-In)                 True
4
FTP Server (FTP Traffic-Out)                True
5
FTP Server Secure (FTP SSL Traffic-In)      True
6
FTP Server Secure (FTP SSL Traffic-Out)     True
7
FTP Server Passive (FTP Passive Traffic-In) True

1
Set-NetFirewallProfile -Profile Domain -Enabled False

1
TcpTestSucceeded : True

1
Set-NetFirewallProfile -Profile Domain -Enabled True

1
New-NetFirewallRule `
2
    -DisplayName "Scanner FTP 21" `
3
    -Direction Inbound `
4
    -Protocol TCP `
5
    -LocalPort 21 `
6
    -Action Allow `
7
    -Profile Domain

Troubleshooting #2: FTP Passive Mode#

After resolving the firewall issue, the client was finally able to establish an FTP connection.

However, a new problem appeared.

The FTP session could be established successfully, but file uploads still failed.

At this point, we knew that:

• Port 21 was reachable.
• The FTP service was running normally.
• Authentication succeeded.

The problem occurred after the control connection had been established.

1
FTP Firewall Support

1
Data Channel Port Range
2

3
50000-50050

1
New-NetFirewallRule `
2
    -DisplayName "FTP Passive Ports" `
3
    -Direction Inbound `
4
    -Protocol TCP `
5
    -LocalPort 50000-50050 `
6
    -Action Allow `
7
    -Profile Domain

1
Restart-Service ftpsvc

Printer Configuration#

Configuring the Brother printer is very straightforward.

FTP Server:

1
192.168.x.x

Port:

1
21

Passive Mode:

1
Enable

Store Directory:

1
MTL-P73

For the Username and Password, enter the local account that was created earlier.

One thing to note is:

The Store Directory is a path relative to the FTP Root.

For example:

1
Root
2

3
C:\FTPScan

Store Directory:

1
MTL-P73

The actual file storage location will be:

1
C:\FTPScan\MTL-P73

Power Automate#

Since the files are stored on a local server, we used:

1
On-premises Data Gateway

to connect to the local file system.

The Flow itself is very simple:

1
When a file is created
2
        │
3
Get file content
4
        │
5
Create file (SharePoint)

No scripts are required.

The entire workflow uses only Microsoft official connectors.

1
On-premises data gateway

1
gateway

1
FTP Scan to SharePoint

1
File System

1
/MTL-P73

1
C:\FTPScan

1
C:\FTPScan\MTL-P73

1
File System

1
body/Id

1
When a file is created (properties only)
2
             │
3
             ▼
4
Get file content
5
             │
6
             ▼
7
SharePoint Create file

Final Result#

The final workflow becomes:

1
Scan
2
    │
3
    ▼
4
FTP
5
    │
6
    ▼
7
Power Automate
8
    │
9
    ▼
10
SharePoint

For end users, nothing changes in the scanning process.

However, every scanned document is ultimately stored in SharePoint, where it benefits from:

• Permission management
• Online collaboration
• Version control
• Centralized Microsoft 365 management

Throughout the entire deployment, the printer does not need to support SharePoint, nor is any third-party software required.

This approach is also easy to replicate for other printers.

Toolbox#

The following PowerShell and Windows commands were used throughout this deployment and can serve as a reference for future deployments and troubleshooting.

1
Get-Service ftpsvc

1
Start-Service ftpsvc

1
Stop-Service ftpsvc

1
Restart-Service ftpsvc

1
netstat -ano | findstr :21

1
LISTENING

1
Test-NetConnection 192.168.x.x -Port 21

1
TcpTestSucceeded

1
ftp 192.168.x.x

1
dir

1
bye

1
Get-NetFirewallProfile

1
Set-NetFirewallProfile -Profile Domain -Enabled False

1
Set-NetFirewallProfile -Profile Domain -Enabled True

1
New-NetFirewallRule `
2
    -DisplayName "Scanner FTP" `
3
    -Direction Inbound `
4
    -Protocol TCP `
5
    -LocalPort 21 `
6
    -Action Allow `
7
    -Profile Domain

1
Get-NetFirewallRule |
2
Where-Object DisplayName -like "*FTP*"