Check ID: teams_email_sending_to_channel_disabled
Provider: Microsoft 365
Service: teams
Severity: HIGH
Categories: email-security, internet-exposed, e3
Resource type: NotDefined

​
What this check verifies

Microsoft 365 Teams tenant configuration for channel email addresses determines if channels can receive messages via email. This evaluates the allow_email_into_channel setting.

​
Risk

Allowing email into channels lets outsiders inject content, links, and attachments into Teams. Leaked addresses enable phishing, malware delivery, and spam, undermining confidentiality and integrity, and adding noise that affects availability; posts may bypass user-authenticated context.

​
Recommendation

Disable email into channels by default. If needed, limit senders to approved domains, apply anti-phishing/malware filtering, enforce DLP and retention on inbound mail, monitor postings, rotate channel addresses, and prefer authenticated connectors-applying least privilege and defense in depth.

​
Remediation

Set-CsTeamsClientConfiguration -Identity Global -AllowEmailIntoChannel $false

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = teams_email_sending_to_channel_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks