Find-SmtpAuthExposure.ps1
|
<#PSScriptInfo .VERSION 1.0.1 .GUID 699c5654-5dd9-4914-b032-fb8744cdb6ec .AUTHOR msgwing.com .COMPANYNAME msgwing.com .COPYRIGHT MIT .TAGS SMTP SMTPAUTH SmtpClientAuthentication BasicAuthentication ExchangeOnline Microsoft365 Office365 Audit ReadOnly Deprecation Relay Printer MFP Scanner 5.7.139 .LICENSEURI https://github.com/msgwing/ZeroSMTP/blob/main/LICENSE .PROJECTURI https://github.com/msgwing/ZeroSMTP .RELEASENOTES Initial release. Reports which Exchange Online mailboxes can still authenticate with SMTP AUTH before Microsoft disables Basic authentication for it by default at the end of December 2026. Read-only. Handles all three states of SmtpClientAuthenticationDisabled, including $null which inherits the tenant setting - the state that the commonly repeated `-eq $false` filter misses entirely. #> #Requires -Version 5.1 <# .SYNOPSIS Reports which Exchange Online mailboxes can still authenticate with SMTP AUTH, and will therefore stop sending when Microsoft disables Basic auth for SMTP AUTH at the end of December 2026. .DESCRIPTION Answers one question before December 2026: which mailboxes in this tenant can still send with a username and password, and will therefore stop when Microsoft disables SMTP AUTH Basic authentication by default at the end of that month. Printers, scanners, MFPs, NAS units and scripts are what break, and the error they will report is 535 5.7.139. Read-only. The script queries configuration and prints a report; it never changes a setting, so it is safe to run against production before you have decided anything. The reason a script is needed rather than one Get-CASMailbox call is that SmtpClientAuthenticationDisabled is tri-state, and the middle state is the one that catches people out: $true SMTP AUTH explicitly blocked for this mailbox $false SMTP AUTH explicitly allowed for this mailbox $null inherit the tenant-wide setting A mailbox showing $null looks harmless in a spreadsheet and is in fact fully exposed whenever the tenant allows SMTP AUTH. Filtering only on `-eq $false`, which is the usual advice, silently misses every one of them. .PARAMETER CsvPath Also write the per-mailbox results to this path, for handing to whoever owns the devices. .PARAMETER SkipConnect Use an Exchange Online session you have already established instead of calling Connect-ExchangeOnline. .EXAMPLE .\Find-SmtpAuthExposure.ps1 .EXAMPLE .\Find-SmtpAuthExposure.ps1 -CsvPath .\smtp-auth-exposure.csv .NOTES Needs the ExchangeOnlineManagement module: Install-Module ExchangeOnlineManagement -Scope CurrentUser Configuration is only half the picture. A mailbox that is allowed to use SMTP AUTH but has no device pointed at it does not matter, and a device nobody remembers configuring does. For actual recent usage, open the Exchange admin center: Reports -> Mail flow -> SMTP AUTH client submission report. That report is the fastest way to find the forgotten device. Part of https://github.com/msgwing/ZeroSMTP #> [CmdletBinding()] param( [string] $CsvPath, [switch] $SkipConnect ) $ErrorActionPreference = 'Stop' function Write-Section { param([string] $Text) Write-Host '' Write-Host $Text -ForegroundColor Cyan Write-Host ('-' * $Text.Length) -ForegroundColor DarkGray } # --- connect --------------------------------------------------------------- if (-not (Get-Command Get-CASMailbox -ErrorAction SilentlyContinue)) { if (-not (Get-Module -ListAvailable -Name ExchangeOnlineManagement)) { throw 'The ExchangeOnlineManagement module is not installed. Run: Install-Module ExchangeOnlineManagement -Scope CurrentUser' } Import-Module ExchangeOnlineManagement -ErrorAction Stop } if (-not $SkipConnect) { Write-Host 'Connecting to Exchange Online...' -ForegroundColor DarkGray Connect-ExchangeOnline -ShowBanner:$false } # --- tenant-wide setting --------------------------------------------------- Write-Section 'Tenant-wide SMTP AUTH' $transport = Get-TransportConfig $tenantBlocks = [bool] $transport.SmtpClientAuthenticationDisabled if ($tenantBlocks) { Write-Host ' SMTP AUTH is DISABLED tenant-wide.' -ForegroundColor Green Write-Host ' Only mailboxes with an explicit per-mailbox override can still use it.' } else { Write-Host ' SMTP AUTH is ALLOWED tenant-wide.' -ForegroundColor Yellow Write-Host ' Every mailbox inherits that unless it opts out explicitly.' } # --- per-mailbox ------------------------------------------------------------ Write-Section 'Per-mailbox configuration' Write-Host ' Reading mailboxes (this takes a while on a large tenant)...' -ForegroundColor DarkGray $mailboxes = Get-CASMailbox -ResultSize Unlimited $results = foreach ($mailbox in $mailboxes) { $setting = $mailbox.SmtpClientAuthenticationDisabled # Tri-state, resolved to the answer the admin actually wants: can this # mailbox authenticate over SMTP AUTH today, and why. if ($null -eq $setting) { $state = 'Inherits tenant' $exposed = -not $tenantBlocks } elseif ($setting) { $state = 'Explicitly blocked' $exposed = $false } else { $state = 'Explicitly allowed' $exposed = $true } [pscustomobject] @{ DisplayName = $mailbox.DisplayName Address = $mailbox.PrimarySmtpAddress Setting = $state BreaksInDec = $exposed } } $exposedList = @($results | Where-Object BreaksInDec) $explicit = @($exposedList | Where-Object Setting -eq 'Explicitly allowed') $inherited = @($exposedList | Where-Object Setting -eq 'Inherits tenant') Write-Host (' {0} mailboxes checked' -f $results.Count) Write-Host (' {0} can still use SMTP AUTH' -f $exposedList.Count) -ForegroundColor ( if ($exposedList.Count) { 'Yellow' } else { 'Green' }) if ($explicit.Count) { Write-Host (' {0} explicitly allowed (someone set this deliberately)' -f $explicit.Count) } if ($inherited.Count) { Write-Host (' {0} inheriting the tenant setting - easy to miss' -f $inherited.Count) } if ($exposedList.Count) { Write-Host '' $exposedList | Sort-Object Setting, Address | Format-Table DisplayName, Address, Setting -AutoSize | Out-String | Write-Host } # --- authentication policies ------------------------------------------------ Write-Section 'Authentication policies' $policies = @(Get-AuthenticationPolicy -ErrorAction SilentlyContinue) if (-not $policies.Count) { Write-Host ' None defined.' } else { foreach ($policy in $policies) { # AllowBasicAuthSmtp is the property that matters here; a policy can # block SMTP AUTH for its assigned users regardless of the settings # above. $allows = $policy.AllowBasicAuthSmtp Write-Host (' {0}: AllowBasicAuthSmtp = {1}' -f $policy.Name, $allows) } } # --- output ----------------------------------------------------------------- if ($CsvPath) { $results | Sort-Object -Property @{ Expression = 'BreaksInDec'; Descending = $true }, Address | Export-Csv -Path $CsvPath -NoTypeInformation -Encoding UTF8 Write-Host '' Write-Host (' Full results written to {0}' -f $CsvPath) -ForegroundColor Cyan } Write-Section 'What to do with this' if ($exposedList.Count) { Write-Host @' Each exposed mailbox is only a problem if something is actually sending through it. Check the SMTP AUTH client submission report in the Exchange admin center (Reports -> Mail flow) to see which ones have authenticated recently, then for each device or application decide: - firmware or software update that adds OAuth 2.0, if the vendor shipped one - Direct Send, for internal-only recipients - an SMTP relay that still accepts a username and password Vendor advisories, including models where the vendor has stated no OAuth firmware is planned: https://github.com/msgwing/ZeroSMTP/blob/main/docs/AFFECTED-SYSTEMS.md '@ } else { Write-Host ' Nothing found that will break. Worth re-running before December.' } Write-Host '' # Exit code carries the finding, so the script is usable from a scheduled task # or a pipeline: 0 means nothing exposed, 1 means something needs attention. if ($exposedList.Count) { exit 1 } else { exit 0 } |