Ensure Direct Send is set to be rejected

Contributed by Bastien PerezAll contributors →

Part of Maester · Exchange Online · Mail flow · All checks

Run this check

Invoke-Maester -TestId MT.1062

Overview

Direct Send SHOULD be configured to Reject in Exchange Online

Rationale: Attackers can exploit direct send to send spam or phishing emails without authentication. Direct Send covers anonymous messages (unauthenticated messages) sent from your own domain to your organization’s mailboxes using the tenant MX.

Remediation action

1. Connect to Exchange Online:

Connect-ExchangeOnline

1. Configure the setting to reject direct send:

Set-OrganizationConfig -RejectDirectSend $true

1. Verify the policy:

(Get-OrganizationConfig).RejectDirectSend

The result should be True.

Related links

• Introducing more control over Direct Send in Exchange Online
• Direct Send: Send mail directly from your device or application to Microsoft 365

Details

Every attribute of this check

Field	Value
Test ID	MT.1062
Severity	Medium
Suite	Maester
Product	Exchange Online
Feature	Mail flow
Area	Email and collaboration protection
Resource type	Tenant
User impact	Medium
Implementation cost	Medium
MITRE ATT&CK	T1566 Phishing, T1684.002 Email Spoofing
Supports controls	nist-800-53-r5:CM-7
PowerShell test	Test-MtExoRejectDirectSend
Services	ExchangeOnline

Source

• Test: tests/maester/exchange/Test.MT.1062.ps1
• Documentation: tests/maester/exchange/Test.MT.1062.md