{
  "id": "CB-M365-COLLAB-017",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-017",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-017.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-017.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-017",
    "title": "Disable email delivery to Teams channels",
    "finding": {
      "title": "Teams channels accept messages sent to their email address",
      "description": "Anyone who learns a channel address can post content and attachments into the channel, bypassing the sender checks applied to chat."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "teams",
      "email",
      "phishing"
    ],
    "applicability": {
      "requires": [
        "Microsoft Teams"
      ]
    },
    "description": "Users cannot send email to a channel email address (`AllowEmailIntoChannel` = `False`), and no SMTP\ndomain is listed in **Accept channel email from these SMTP domains**.\n",
    "rationale": "Channel addresses are static and often end up in mailing lists, forwarding rules or leaked\ndocuments. Mail posted into a channel appears as channel content that members trust, which makes it\na phishing and malware delivery path into Teams that does not depend on external access settings.\n",
    "impact": "Workflows that post to channels by email (alerts, newsletters, forwarding) stop working. Replace\nthem with Power Automate flows, the Workflows app or incoming webhooks under app governance.\n",
    "setting": {
      "location": "Teams admin center > Teams > Teams settings > Email integration > Users can send emails to a channel email address",
      "default_value": "On",
      "recommended_value": "Off (AllowEmailIntoChannel = False)"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Teams admin center (https://admin.teams.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Teams** > **Teams settings** > **Email integration** and check that **Users can send\n   emails to a channel email address** is **Off**.\n3. With Microsoft Teams PowerShell:\n   `Get-CsTeamsClientConfiguration -Identity Global | Select-Object AllowEmailIntoChannel, RestrictedSenderList`.\n4. Fail if `AllowEmailIntoChannel` is `True`.\n"
    },
    "remediation": {
      "manual": "1. Identify channels that receive email (ask team owners, or look for mail flow to `*.teams.ms`\n   addresses in the Exchange message trace) and plan replacements.\n2. In the Teams admin center, browse to **Teams** > **Teams settings** > **Email integration**, turn\n   off **Users can send emails to a channel email address** and clear the accepted domains. Select\n   **Save**. Role: Teams Administrator.\n3. PowerShell equivalent:\n   `Set-CsTeamsClientConfiguration -Identity Global -AllowEmailIntoChannel $false`.\n"
    },
    "references": [
      {
        "title": "Set-CsTeamsClientConfiguration",
        "url": "https://learn.microsoft.com/powershell/module/microsoftteams/set-csteamsclientconfiguration",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Teams settings and policies reference",
        "url": "https://learn.microsoft.com/microsoftteams/settings-policies-reference",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Teams baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/teams.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.TEAMS.4.1v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-8",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SC-7",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1566"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}