CISA.MS.EXO.5.1 - SMTP AUTH SHALL be disabled.

Contributed by Michael Soule with Merill FernandoAll contributors →

Overview

SMTP AUTH SHALL be disabled.

Rationale: SMTP AUTH is not used or needed by modern email clients. Therefore, disabling it as the global default conforms to the principle of least functionality.

Remediation action:

1. To disable SMTP AUTH for the organization:
2. Sign in to the Exchange admin center.
3. On the left hand pane, select Settings; then from the settings list, select Mail Flow.
4. Make sure the setting Turn off SMTP AUTH protocol for your organization is checked.

Related links

• Exchange admin center - Settings
• CISA 5 Simple Mail Transfer Protocol Authentication - MS.EXO.5.1v1
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.EXO.5.1
Severity	High
Suite	CISA
Product	Exchange Online
Feature	Client access
Area	Authentication
Resource type	Tenant
User impact	Medium
Implementation cost	Medium
MITRE ATT&CK	None
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.5.1
Criticality	SHALL
Upstream requirement	MS.EXO.5.1v1
Supports controls	cisa-scuba:MS.EXO.5.1, nist-800-53-r5:CM-7
PowerShell test	Test-MtCisaSmtpAuthentication
Services	ExchangeOnline

Source

• Test: tests/cisa/exchange/Test.CISA.MS.EXO.5.1.ps1
• Documentation: tests/cisa/exchange/Test.CISA.MS.EXO.5.1.md