(L1) Ensure users can't send emails to a channel email address

Contributed by jeremy finneyAll contributors →

Part of CIS · Teams · Messaging · All checks

Run this check

Invoke-Maester -TestId CIS.M365.8.1.2

Overview

Channel email addresses let a user send an email into a Teams channel. An attacker who learns or guesses such an address can post content into the channel, which members may trust because it appears in the team. Blocking this removes a path for unsolicited and phishing content into channels.

When the setting is off, channel members can still post in Teams. Only the email-to-channel entry point is closed, so users who relied on it need another way to share content.

Remediation action

1. Sign in to the Microsoft Teams admin center.
2. Go to Teams > Teams settings.
3. Under Email integration, turn off Users can send emails to a channel email address.
4. Select Save.

PowerShell

1. Connect to Teams PowerShell using Connect-MicrosoftTeams.
2. Run the following command:

Set-CsTeamsClientConfiguration -Identity Global -AllowEmailIntoChannel $false

Related links

• Microsoft Teams admin center
• Set-CsTeamsClientConfiguration (AllowEmailIntoChannel)
• Set-CsTeamsClientConfiguration
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 8.1.2

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.8.1.2
Severity	Medium
Suite	CIS
Product	Teams
Feature	Messaging
Area	External access and sharing
Resource type	Tenant
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	T1566 Phishing
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 8.1.2
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:8.1.2, nist-800-53-r5:AC-20
PowerShell test	Test-MtCisTeamsEmailToChannelDisabled
Services	Teams

Source

• Test: tests/cis/Test.CIS.M365.8.1.2.ps1
• Documentation: tests/cis/Test.CIS.M365.8.1.2.md