{
  "id": "CB-M365-MAIL-009",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-009",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-009.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-009.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-009",
    "title": "Disable SMTP AUTH client submission for the organization",
    "finding": {
      "title": "Authenticated SMTP submission is enabled for the organization",
      "description": "SMTP AUTH accepts a user name and password from any client, which lets attackers test stolen or sprayed passwords and send mail as the user."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "exchange-online",
      "smtp-auth",
      "legacy-authentication",
      "password-spray"
    ],
    "description": "SMTP AUTH client submission (port 587 on `smtp.office365.com`) is turned off for the whole\norganization (`SmtpClientAuthenticationDisabled $true`). Mailboxes that still need it, typically\ndevices or applications that cannot use another method, are listed exceptions enabled one by one\n(`Set-CASMailbox -SmtpClientAuthenticationDisabled $false`) and use OAuth where possible.\n\nEvery other mailbox has the per-mailbox value empty (inherit the organization setting) or `True`.\n",
    "rationale": "SMTP AUTH is a frequent target of password spray because it often still accepts basic\nauthentication and returns a clear success or failure. A valid password lets the attacker send\nmail from a legitimate mailbox. Microsoft disables basic authentication for SMTP AUTH by default\nat the end of 2026 and plans to remove it in the second half of 2027; turning the protocol off\nwhere it is not needed also closes the OAuth path for unused mailboxes.\n",
    "impact": "Scanners, printers, line-of-business applications and scripts that send through\n`smtp.office365.com` with a mailbox account stop working unless their mailbox is an exception.\nInventory them first with the **SMTP AUTH clients** report (Exchange admin center > **Reports** >\n**Mail flow**) and move them to Microsoft Graph, High Volume Email, or a connector-based relay.\n",
    "audit": {
      "manual": "1. Sign in to the Exchange admin center (https://admin.exchange.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Settings** > **Mail flow** and check that **Turn off SMTP AUTH protocol for your\n   organization** is selected.\n3. In Exchange Online PowerShell (read-only):\n   ```powershell\n   Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled\n   Get-CASMailbox -ResultSize Unlimited -Filter \"SmtpClientAuthenticationDisabled -eq $false\" |\n     Format-Table PrimarySmtpAddress, SmtpClientAuthenticationDisabled\n   ```\n4. Fail if `SmtpClientAuthenticationDisabled` is `False` at organization level, or if a mailbox\n   with the per-mailbox value `False` is not a documented exception.\n"
    },
    "remediation": {
      "manual": "1. Review the **SMTP AUTH clients** report and the sign-in logs (client app **Authenticated\n   SMTP**) to find the remaining users.\n2. Enable the exceptions first, mailbox by mailbox (Exchange Administrator):\n   ```powershell\n   Set-CASMailbox -Identity scanner@example.com -SmtpClientAuthenticationDisabled $false\n   ```\n3. In the Exchange admin center, browse to **Settings** > **Mail flow**, select **Turn off SMTP\n   AUTH protocol for your organization** and save. PowerShell equivalent:\n   ```powershell\n   Set-TransportConfig -SmtpClientAuthenticationDisabled $true\n   ```\n4. Block legacy authentication with Conditional Access so the exceptions use OAuth.\n",
      "rollback": "`Set-TransportConfig -SmtpClientAuthenticationDisabled $false`, or enable SMTP AUTH on the single\nmailbox that needs it.\n"
    },
    "references": [
      {
        "title": "Enable or disable authenticated client SMTP submission (SMTP AUTH) in Exchange Online",
        "url": "https://learn.microsoft.com/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-TransportConfig",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/set-transportconfig",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Exchange Online baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.EXO.5.1v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-2",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1110.003"
      },
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-006",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-010",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-001",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}