What this check looks at
Checks, in Exchange Online, that SMTP AUTH client submission is off for the organisation, leaving exceptions only for the mailboxes that need it.
SMTP AUTH (authenticated SMTP client submission to Exchange Online on port 587) lets a device or app send mail through Exchange Online by signing in as a mailbox. Multifunction printers that scan to email, line-of-business apps, website contact forms and a few old mail clients use it. Exchange Online has an organisation-wide switch to turn it off, with per-mailbox exceptions, and in many tenants it is still on for everyone.
This check reads the organisation-wide transport setting (SmtpClientAuthenticationDisabled) from Exchange Online. The check fails when SMTP AUTH is on for the organisation, so every mailbox without its own setting can be used to send mail this way.
SMTP AUTH is a favourite target for password spraying, because older set-ups accept a plain password and Conditional Access policies often leave it out. Once a password works, the attacker sends phishing and spam from a genuine company mailbox that passes the organisation’s own SPF, DKIM and DMARC. Microsoft is retiring Basic authentication for SMTP AUTH, so devices that still send with a password will need moving anyway.
Why it matters
SMTP AUTH lets anything with a mailbox password send mail as that person, and it is a favourite target for password spraying because it is often left out of Conditional Access. A compromised mailbox becomes a spam and phishing relay that carries the company’s name.
A typical case: a 30-person surveyors’ practice has SMTP AUTH on for every mailbox. A receptionist’s reused password is sprayed and works over SMTP AUTH, which was left out of the MFA rollout. Overnight the account sends thousands of phishing emails to the practice’s contacts; Microsoft restricts the mailbox from sending, the domain’s reputation suffers, and clients receive fake invoices that look entirely genuine.
Most organisations need SMTP AUTH on one or two mailboxes at most, such as a scanner or an app. Turning it off for everyone else removes a whole attack route, and devices that cannot use modern authentication can relay through a connector instead.
CIS Microsoft 365 Foundations Benchmark 6.5.4 asks for SMTP AUTH to be disabled, and CISA SCuBA MS.EXO.5.1 asks the same. CIS Controls v8 safeguard 4.8 (disable unnecessary services), ISO 27001 A.8.5 and A.8.9, the NCSC CAF secure configuration outcome and NIST CSF PR.PS-01 support it.
How to fix it
Where: Microsoft 365 admin centre → Settings → Org settings → Modern authentication
Before you start
- List what sends mail through Microsoft 365’s SMTP submission (SMTP AUTH): multifunction printers, scanners, website forms, line-of-business apps.
- For each, allow SMTP AUTH on its own mailbox (Set-CASMailbox -SmtpClientAuthenticationDisabled $false) or move it to a connector.
Step by step
- Find what sends with SMTP AUTH. In the Exchange admin centre, open Reports > Mail flow and run the SMTP AUTH clients report to see which mailboxes have sent with SMTP AUTH recently. In the Microsoft Entra admin centre, Entra ID > Monitoring & health > Sign-in logs, filter Client app on Authenticated SMTP for the last 30 days. List the scanners, apps and forms behind each mailbox.
- Choose a route for each sender. For each device or app, choose an exception on its own dedicated mailbox (if it supports OAuth, or until it can be moved), a connector that relays mail from the office’s fixed IP address (Exchange admin centre > Mail flow > Connectors), or a dedicated sending service. Avoid putting the exception on a person’s mailbox.
- Allow SMTP AUTH only where needed. In the Exchange admin centre, Recipients > Mailboxes, open each mailbox that must keep SMTP AUTH, select Manage email apps settings and turn on Authenticated SMTP. In Exchange Online PowerShell: Set-CASMailbox -Identity scanner@contoso.co.uk -SmtpClientAuthenticationDisabled $false.
- Turn it off for the organisation. In Exchange Online PowerShell run Set-TransportConfig -SmtpClientAuthenticationDisabled $true. In the Exchange admin centre the same switch is under Settings > Mail flow: Turn off SMTP AUTH protocol for your organisation.
- Check the excepted senders still work. Send a test from each scanner or app that kept its exception and check it arrives. Watch the SMTP AUTH clients report for a few days for anything that started failing.
- Confirm only the exceptions remain. Run Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled and check it shows True, and Get-CASMailbox -ResultSize Unlimited | Where-Object { $_.SmtpClientAuthenticationDisabled -eq $false } | Select-Object Name to check only the mailboxes you excepted are listed. The finding clears at the next assessment.
With PowerShell
Set-TransportConfig -SmtpClientAuthenticationDisabled $true
What users will notice
None for people using Outlook. Devices and apps that send with a mailbox password stop sending unless given an exception.
How to confirm it worked
Get-TransportConfig shows SmtpClientAuthenticationDisabled as True, and test sends from each excepted device still arrive.
Frameworks and controls
This check maps to controls in 15 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisationB4.b Secure configuration |
| DSPT | Standard 9: IT protection |
| NIS2 | Art. 21(2)(j) Multi-factor authentication and secured communications |
| Microsoft Cloud Security Benchmark | IM-7 Restrict resource access based on conditions |
| Zero Trust | Identities |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| PCI DSS 4.0.1 | 8.4.3 MFA for all remote network access |
| NIST SP 800-171 | 3.5.3 Use multi-factor authentication |
| CMMC Level 2 | IA.L2-3.5.3 Multifactor Authentication |
| ISO 27001:2022 | A.8.5 Secure authenticationA.8.9 Configuration management |
| CISA SCuBA | MS.EXO.5.1v1 SMTP AUTH disabled |
| CIS M365 | 6.5.4 Ensure SMTP AUTH is disabled |
| CIS Controls v8.1 | 4.8 Uninstall or disable unnecessary services on enterprise assets and software (IG2) |
| NIST CSF 2.0 | PR.PS-01: Configuration management practices are established and applied |
| NCSC 10 Steps | Architecture and configurationIdentity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Enable or disable SMTP AUTH in Exchange Online (Microsoft Learn)