MT.1076 - MOERA SHOULD NOT be used for sent mail

Contributed by Michael Soule with 2 co-contributorsAll contributors →

Overview

Microsoft Online Exchange Routing Addresses (MOERA) SHOULD NOT be used for sent mail.

Remediation action:

For each listed user principal name, update primary SMTP address to use a registered domain.

If the listed user principal name sends mail from a script or application, you may need to update that configuration as well.

Entra Managed Mail Attributes

1. Within the Entra Portal, navigate to All users

2. Select the user

3. Select Edit properties

4. Select Contact information

5. Update the Email attribute

6. Select Save

AD Managed Mail Attributes

Processes can vary depending on use of PowerShell, AD MMCs, or Exchange Management Portal. Update according to your internal processes.

Related links

• Limiting Onmicrosoft Domain Usage for Sending Emails

Test Metadata

Field	Value
Test ID	MT.1076
Severity	Low
Suite	Maester
Product	Exchange Online
Feature	Mailboxes
Area	Email and collaboration protection
Resource type	User
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	None
PowerShell test	Test-MtExoMoeraMailActivity
Services	Graph

Source

• Test: tests/maester/exchange/Test.MT.1076.ps1
• Documentation: tests/maester/exchange/Test.MT.1076.md