CIS.M365.6.5.5 - (L2) Ensure Direct Send submissions are rejected
Overview
Exchange Online rejects Direct Send submissions: unauthenticated messages sent to your tenant where the envelope sender (MAIL FROM) domain is one of your accepted domains and no eligible inbound connector matches the message.
Direct Send lets a device or application send mail to your tenant, from an address in your own domain, without signing in. Attackers use the same path to send phishing that looks like internal mail. When RejectDirectSend is turned on, Exchange Online rejects these messages instead of delivering them. It does not reject every anonymous message that shows an internal sender address. For example, a message can use an external envelope sender and still show one of your addresses in the From header. Anti-spoofing controls such as SPF, DKIM, DMARC and spoof intelligence are still needed for those messages.
Before you turn it on, find the devices and applications that rely on Direct Send, for example printers and scanners. Move them to authenticated SMTP submission, SMTP relay with a connector or High Volume Email.
Remediation action
- Connect to Exchange Online with
Connect-ExchangeOnline. - Run
Set-OrganizationConfig -RejectDirectSend $true. - Check the setting with
Get-OrganizationConfig | Format-List RejectDirectSend.
Related links
- Direct Send: Send mail directly from your device or application to Microsoft 365
- Set-OrganizationConfig
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.5.5
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.6.5.5 |
| Severity | Medium |
| Suite | CIS |
| Product | Exchange Online |
| Feature | Mail flow |
| Area | Email and collaboration protection |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1566 Phishing, T1684.002 Email Spoofing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.5.5 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2 |
| Supports controls | cis-m365:6.5.5, nist-800-53-r5:SI-8 |
| PowerShell test | Test-MtCisDirectSendRejected |
| Services | ExchangeOnline |
Source
- Test:
tests/cis/Test.CIS.M365.6.5.5.ps1 - Documentation:
tests/cis/Test.CIS.M365.6.5.5.md