# (L1) Ensure SMTP AUTH is disabled

Authenticated SMTP submission (SMTP AUTH) is turned off for the whole organisation.

Source: https://maester.dev/docs/tests/CIS.M365.6.5.4

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Exchange Online · Client access · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.6.5.4
```

## Overview

Authenticated SMTP submission (SMTP AUTH) is turned off for the whole organisation.

SMTP AUTH is used by scanners, applications and older mail clients to send mail. It supports both basic authentication and OAuth. When it is used with basic authentication, it cannot be protected with MFA, and it is a common target for password spray and for sending spam from a compromised mailbox.

Turning off SMTP AUTH blocks all SMTP AUTH submissions, including those that use OAuth. Before you disable it, find the devices and applications that still use it, for example with the SMTP AUTH client submission report. Then move them to a different submission method, such as SMTP relay with a connector, High Volume Email, or the Microsoft Graph API with OAuth. You can turn SMTP AUTH back on for single mailboxes that must keep it.

#### Remediation action

To turn off SMTP AUTH in the Exchange admin center:

1. Go to [Exchange admin center > Settings > Mail flow](https://admin.exchange.microsoft.com/#/settings).
2. Select **Turn off SMTP AUTH protocol for your organization**.
3. Select **Save**.

To turn off SMTP AUTH with PowerShell:

1. Connect to Exchange Online with `Connect-ExchangeOnline`.
2. Run `Set-TransportConfig -SmtpClientAuthenticationDisabled $true`.
3. Check the setting with `Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled`.

#### Related links

* [Exchange admin center - Mail flow settings](https://admin.exchange.microsoft.com/#/settings)
* [Enable or disable authenticated client SMTP submission (SMTP AUTH)](https://learn.microsoft.com/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission)
* [How to set up a multifunction device or application to send email](https://learn.microsoft.com/exchange/mail-flow-best-practices/how-to-set-up-a-multifunction-device-or-application-to-send-email-using-microsoft-365-or-office-365)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.5.4](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.6.5.4 |
| Severity | High |
| Suite | CIS |
| Product | Exchange Online |
| Feature | Client access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1110.003 Password Spraying |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.5.4 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:6.5.4, nist-800-53-r5:CM-7 |
| PowerShell test | [Test-MtCisSmtpAuthDisabled](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.5.4.ps1) |
| Services | ExchangeOnline |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.6.5.4.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.5.4.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.6.5.4.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.5.4.md)