MT.1062 - Ensure Direct Send is set to be rejected
Overview
Direct Send SHOULD be configured to Reject in Exchange Online
Rationale: Attackers can exploit direct send to send spam or phishing emails without authentication. Direct Send covers anonymous messages (unauthenticated messages) sent from your own domain to your organization's mailboxes using the tenant MX.
Remediation action
- Connect to Exchange Online:
Connect-ExchangeOnline
- Configure the setting to reject direct send:
Set-OrganizationConfig -RejectDirectSend $true
- Verify the policy:
(Get-OrganizationConfig).RejectDirectSend
The result should be True.
Related links
- Introducing more control over Direct Send in Exchange Online
- Direct Send: Send mail directly from your device or application to Microsoft 365
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1062 |
| Severity | Medium |
| Suite | Maester |
| Product | Exchange Online |
| Feature | Mail flow |
| Area | Email and collaboration protection |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1566 Phishing, T1684.002 Email Spoofing |
| Supports controls | nist-800-53-r5:CM-7 |
| PowerShell test | Test-MtExoRejectDirectSend |
| Services | ExchangeOnline |
Source
- Test:
tests/maester/exchange/Test.MT.1062.ps1 - Documentation:
tests/maester/exchange/Test.MT.1062.md