SMTP AUTH SHALL be disabled

Contributed by Michael Soule with Merill FernandoAll contributors →

Part of CISA · Exchange Online · Client access · All checks

Run this check

Invoke-Maester -TestId CISA.MS.EXO.5.1

Overview

SMTP AUTH SHALL be disabled.

Rationale: SMTP AUTH is not used or needed by modern email clients. Therefore, disabling it as the global default conforms to the principle of least functionality.

Remediation action:

1. To disable SMTP AUTH for the organization:
2. Sign in to the Exchange admin center.
3. On the left hand pane, select Settings; then from the settings list, select Mail Flow.
4. Make sure the setting Turn off SMTP AUTH protocol for your organization is checked.

Related links

• Exchange admin center - Settings
• CISA 5 Simple Mail Transfer Protocol Authentication - MS.EXO.5.1v1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.EXO.5.1
Severity	High
Suite	CISA
Product	Exchange Online
Feature	Client access
Area	Authentication
Resource type	Tenant
User impact	Medium
Implementation cost	Medium
MITRE ATT&CK	None
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.5.1
Criticality	SHALL
Upstream requirement	MS.EXO.5.1v1
Supports controls	cisa-scuba:MS.EXO.5.1, nist-800-53-r5:CM-7
PowerShell test	Test-MtCisaSmtpAuthentication
Services	ExchangeOnline

Source

• Test: tests/cisa/exchange/Test.CISA.MS.EXO.5.1.ps1
• Documentation: tests/cisa/exchange/Test.CISA.MS.EXO.5.1.md