SMTP AUTH is disabled in Exchange Online transport

​

What this check verifies

Microsoft 365 Exchange Online transport configuration disables authenticated SMTP submission (SMTP AUTH) at the organization level

​

Risk

With SMTP AUTH enabled, attackers can:

• Launch password spraying against mailboxes
• Bypass MFA on SMTP submissions
• Send unauthorized email, enabling internal spoofing and phishing

This undermines message integrity, aids lateral movement, and harms tenant reputation and deliverability.

​

Recommendation

Disable SMTP AUTH tenant-wide and allow per-mailbox exceptions only when justified, time-bound, and monitored. Prefer modern authentication and secure submission alternatives. Apply least privilege and defense in depth, restrict app access, rotate secrets, and monitor send patterns for anomalies.

​

Remediation

​

References

• https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = exchange_transport_config_smtp_auth_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks