(L2) Ensure Direct Send submissions are rejected
Part of CIS · Exchange Online · Mail flow · All checks
Invoke-Maester -TestId CIS.M365.6.5.5Overview
Section titled “Overview”Exchange Online rejects Direct Send submissions: unauthenticated messages sent to your tenant where the envelope sender (MAIL FROM) domain is one of your accepted domains and no eligible inbound connector matches the message.
Direct Send lets a device or application send mail to your tenant, from an address in your own domain, without signing in. Attackers use the same path to send phishing that looks like internal mail. When RejectDirectSend is turned on, Exchange Online rejects these messages instead of delivering them. It does not reject every anonymous message that shows an internal sender address. For example, a message can use an external envelope sender and still show one of your addresses in the From header. Anti-spoofing controls such as SPF, DKIM, DMARC and spoof intelligence are still needed for those messages.
Before you turn it on, find the devices and applications that rely on Direct Send, for example printers and scanners. Move them to authenticated SMTP submission, SMTP relay with a connector or High Volume Email.
Remediation action
Section titled “Remediation action”- Connect to Exchange Online with
Connect-ExchangeOnline. - Run
Set-OrganizationConfig -RejectDirectSend $true. - Check the setting with
Get-OrganizationConfig | Format-List RejectDirectSend.
Related links
Section titled “Related links”- Direct Send: Send mail directly from your device or application to Microsoft 365
- Set-OrganizationConfig
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.5.5
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | CIS.M365.6.5.5 |
| Severity | Medium |
| Suite | CIS |
| Product | Exchange Online |
| Feature | Mail flow |
| Area | Email and collaboration protection |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1566 Phishing, T1684.002 Email Spoofing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.5.5 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2 |
| Supports controls | cis-m365:6.5.5, nist-800-53-r5:SI-8 |
| PowerShell test | Test-MtCisDirectSendRejected |
| Services | ExchangeOnline |
Source
Section titled “Source”- Test:
tests/cis/Test.CIS.M365.6.5.5.ps1 - Documentation:
tests/cis/Test.CIS.M365.6.5.5.md