What this check looks at
Checks whether people can send email to a Teams channel’s email address.
Any Teams channel can be given an email address (Get email address in the channel’s menu). Mail sent to it is posted in the channel as a message, with the original attached. The feature is on by default for the whole organisation and is controlled by AllowEmailIntoChannel in the Global Teams client configuration.
The check fails when AllowEmailIntoChannel is true, and reports not checked when the Teams client settings came back without it.
Channel addresses are long random strings at teams.ms, but they spread: they get typed into supplier systems, forwarded and pasted into tickets. Unless the channel owner has limited senders in the channel’s advanced email settings, which few do, anyone who has the address can post into the channel from anywhere. A phishing link or malicious attachment then appears inside Teams as part of the team’s own conversation, without the external-sender warnings and banners people are used to in Outlook.
Why it matters
A channel email address accepts mail from anyone who learns it, and that mail skips the warnings people see in Outlook. It is an easy way to put a phishing message in front of a whole team.
A typical case: an accounts team uses a channel address to collect supplier invoices. An attacker finds it in a forwarded email and sends an "updated bank details" letter. It appears in the channel among genuine invoices, the team trusts it because it is in Teams, and the next payment run sends thousands of pounds to the attacker’s account. Invoice redirection like this is one of the most common frauds against UK businesses, and the money is rarely recovered.
Mail posted into a channel does not sit in a mailbox, so the tools built around email (the Report button, mail flow rules, mailbox audit records) do not work on it the way they do in Outlook. It is a weaker path into the organisation than ordinary email, for little benefit.
CIS Microsoft 365 Foundations Benchmark 8.1.2 and CISA SCuBA MS.TEAMS.4.1v1 both ask for Teams email integration to be turned off. Processes that rely on it can move to a Power Automate flow or a connector that posts from a monitored mailbox.
How to fix it
Where: Teams admin centre → Teams → Teams settings → Email integration
Before you start
- Check whether any process sends mail into a channel (alerts from a system, a shared inbox forwarding to a team) and move it to a connector or a Power Automate flow.
Step by step
- Find anything that sends mail into channels. Ask team owners which channels have an email address and what sends to it. Check monitoring tools, line-of-business systems, scanners and mailbox forwarding rules for addresses ending in teams.ms. Each one needs a replacement before the switch is turned off.
- Replace the channel address where it is still needed. For each real use, have the mail go to a shared mailbox instead, and post to the channel with a Power Automate flow triggered by "When a new email arrives" on that mailbox, using the Microsoft Teams "Post message in a chat or channel" action. The mailbox then gets your normal mail filtering and auditing.
- Turn off email into channels. In the Teams admin centre, go to Teams > Teams settings and scroll to Email integration. Set "Users can send emails to a channel email address" to Off and select Save.
- Or make the change in Teams PowerShell. Install the Teams PowerShell module if it is not already there (Install-Module MicrosoftTeams), then run Connect-MicrosoftTeams and sign in as a Teams Administrator. Run Set-CsTeamsClientConfiguration -Identity Global -AllowEmailIntoChannel $false.
- Confirm the change. Run Get-CsTeamsClientConfiguration | Select-Object AllowEmailIntoChannel: it should show False. Channels no longer offer Get email address, and a test message to an old channel address is returned to the sender.
With PowerShell
Connect-MicrosoftTeams Set-CsTeamsClientConfiguration -Identity Global -AllowEmailIntoChannel $false
What users will notice
Channels no longer show "Get email address", and mail sent to an existing channel address is returned to the sender.
How to confirm it worked
Get-CsTeamsClientConfiguration | Select-Object AllowEmailIntoChannel shows False; a test message to an old channel address is rejected.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B4.b Secure configuration |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Applications |
| SOC 2 | CC6.6 Protection against threats from outside the system boundaries |
| PCI DSS 4.0.1 | 2.2.4 Only necessary services, protocols and functions are enabled |
| NIST SP 800-171 | 3.4.6 Employ the principle of least functionality |
| CMMC Level 2 | CM.L2-3.4.6 Least Functionality |
| ISO 27001:2022 | A.5.14 Information transferA.8.9 Configuration management |
| CISA SCuBA | MS.TEAMS.4.1v1 Teams email integration disabled |
| CIS M365 | 8.1.2 Ensure users can't send emails to a channel email address |
| CIS Controls v8.1 | 4.8 Uninstall or disable unnecessary services on enterprise assets and software (IG2) |
| NIST CSF 2.0 | PR.PS-01: Configuration management practices are established and applied |
| NCSC 10 Steps | Architecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Set-CsTeamsClientConfiguration (Microsoft Learn)