Disable SMTP AUTH client submission for the organization

Description

SMTP AUTH client submission (port 587 on smtp.office365.com) is turned off for the whole organization (SmtpClientAuthenticationDisabled $true). Mailboxes that still need it, typically devices or applications that cannot use another method, are listed exceptions enabled one by one (Set-CASMailbox -SmtpClientAuthenticationDisabled $false) and use OAuth where possible.

Every other mailbox has the per-mailbox value empty (inherit the organization setting) or True.

Rationale

SMTP AUTH is a frequent target of password spray because it often still accepts basic authentication and returns a clear success or failure. A valid password lets the attacker send mail from a legitimate mailbox. Microsoft disables basic authentication for SMTP AUTH by default at the end of 2026 and plans to remove it in the second half of 2027; turning the protocol off where it is not needed also closes the OAuth path for unused mailboxes.

Impact

Scanners, printers, line-of-business applications and scripts that send through smtp.office365.com with a mailbox account stop working unless their mailbox is an exception. Inventory them first with the SMTP AUTH clients report (Exchange admin center > Reports > Mail flow) and move them to Microsoft Graph, High Volume Email, or a connector-based relay.

Audit

1. Sign in to the Exchange admin center (https://admin.exchange.microsoft.com) as at least a Global Reader.
2. Browse to Settings > Mail flow and check that Turn off SMTP AUTH protocol for your organization is selected.
3. In Exchange Online PowerShell (read-only):

   Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled
   Get-CASMailbox -ResultSize Unlimited -Filter "SmtpClientAuthenticationDisabled -eq $false" |
     Format-Table PrimarySmtpAddress, SmtpClientAuthenticationDisabled
   

4. Fail if SmtpClientAuthenticationDisabled is False at organization level, or if a mailbox with the per-mailbox value False is not a documented exception.

Remediation

1. Review the SMTP AUTH clients report and the sign-in logs (client app Authenticated SMTP) to find the remaining users.
2. Enable the exceptions first, mailbox by mailbox (Exchange Administrator):

   Set-CASMailbox -Identity [email protected] -SmtpClientAuthenticationDisabled $false
   

3. In the Exchange admin center, browse to Settings > Mail flow, select Turn off SMTP AUTH protocol for your organization and save. PowerShell equivalent:

   Set-TransportConfig -SmtpClientAuthenticationDisabled $true
   

4. Block legacy authentication with Conditional Access so the exceptions use OAuth.

Rollback

Set-TransportConfig -SmtpClientAuthenticationDisabled $false, or enable SMTP AUTH on the single mailbox that needs it.

References

• Enable or disable authenticated client SMTP submission (SMTP AUTH) in Exchange Online Microsoft, vendor-doc, accessed 2026-10-24
• Set-TransportConfig Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Exchange Online baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-006 Keep modern authentication enabled for Exchange Online
• related CB-M365-MAIL-010 Reject Direct Send messages that claim to come from the organization
• related CB-M365-AUTH-001 Block legacy authentication with Conditional Access

People and lifecycle