Skip to main content
Version: 3.0.0-preview

CIS.M365.6.5.4 - (L1) Ensure SMTP AUTH is disabled

jeremy finney
Contributed by jeremy finneyAll contributors →

Overview​

Authenticated SMTP submission (SMTP AUTH) is turned off for the whole organisation.

SMTP AUTH is used by scanners, applications and older mail clients to send mail. It supports both basic authentication and OAuth. When it is used with basic authentication, it cannot be protected with MFA, and it is a common target for password spray and for sending spam from a compromised mailbox.

Turning off SMTP AUTH blocks all SMTP AUTH submissions, including those that use OAuth. Before you disable it, find the devices and applications that still use it, for example with the SMTP AUTH client submission report. Then move them to a different submission method, such as SMTP relay with a connector, High Volume Email, or the Microsoft Graph API with OAuth. You can turn SMTP AUTH back on for single mailboxes that must keep it.

Remediation action​

To turn off SMTP AUTH in the Exchange admin center:

  1. Go to Exchange admin center > Settings > Mail flow.
  2. Select Turn off SMTP AUTH protocol for your organization.
  3. Select Save.

To turn off SMTP AUTH with PowerShell:

  1. Connect to Exchange Online with Connect-ExchangeOnline.
  2. Run Set-TransportConfig -SmtpClientAuthenticationDisabled $true.
  3. Check the setting with Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled.

Test Metadata​

FieldValue
Test IDCIS.M365.6.5.4
SeverityHigh
SuiteCIS
ProductExchange Online
FeatureClient access
AreaAuthentication
Resource typeTenant
User impactMedium
Implementation costMedium
MITRE ATT&CKT1078.004 Cloud Accounts, T1110.003 Password Spraying
Supports benchmarkCIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.5.4
Benchmark levelL1
Benchmark profilesE3 Level 1
Supports controlscis-m365:6.5.4, nist-800-53-r5:CM-7
PowerShell testTest-MtCisSmtpAuthDisabled
ServicesExchangeOnline

Source​