Disable email delivery to Teams channels

Description

Users cannot send email to a channel email address (AllowEmailIntoChannel = False), and no SMTP domain is listed in Accept channel email from these SMTP domains.

Rationale

Channel addresses are static and often end up in mailing lists, forwarding rules or leaked documents. Mail posted into a channel appears as channel content that members trust, which makes it a phishing and malware delivery path into Teams that does not depend on external access settings.

Impact

Workflows that post to channels by email (alerts, newsletters, forwarding) stop working. Replace them with Power Automate flows, the Workflows app or incoming webhooks under app governance.

Applies when

Requires: Microsoft Teams

Setting

Audit

1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a Global Reader.
2. Browse to Teams > Teams settings > Email integration and check that Users can send emails to a channel email address is Off.
3. With Microsoft Teams PowerShell: Get-CsTeamsClientConfiguration -Identity Global | Select-Object AllowEmailIntoChannel, RestrictedSenderList.
4. Fail if AllowEmailIntoChannel is True.

Remediation

1. Identify channels that receive email (ask team owners, or look for mail flow to *.teams.ms addresses in the Exchange message trace) and plan replacements.
2. In the Teams admin center, browse to Teams > Teams settings > Email integration, turn off Users can send emails to a channel email address and clear the accepted domains. Select Save. Role: Teams Administrator.
3. PowerShell equivalent: Set-CsTeamsClientConfiguration -Identity Global -AllowEmailIntoChannel $false.

References

• Set-CsTeamsClientConfiguration Microsoft, vendor-doc, accessed 2026-10-24
• Teams settings and policies reference Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Teams baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle