Find-SmtpAuthSenders

1.0.0

READ-ONLY: this script changes nothing in your tenant. It combines up to four sources:

 1. SMTP AUTH settings (always): the tenant setting (Get-TransportConfig) and every mailbox
    (Get-EXOCASMailbox). An empty mailbox value means "use the tenant setting".
 2. -IncludeUsageReport: the Microsoft 365 email app usage report (Microsoft Graph
    getEmailAppUsageUse
READ-ONLY: this script changes nothing in your tenant. It combines up to four sources:

 1. SMTP AUTH settings (always): the tenant setting (Get-TransportConfig) and every mailbox
    (Get-EXOCASMailbox). An empty mailbox value means "use the tenant setting".
 2. -IncludeUsageReport: the Microsoft 365 email app usage report (Microsoft Graph
    getEmailAppUsageUserDetail, last 180 days) - which users sent with an "SMTP App".
    Needs the Reports.Read.All permission and a role such as Reports Reader.
 3. -IncludeSignInLogs: Entra ID sign-in logs with client app "Authenticated SMTP" - user,
    IP address (helps you find the physical device) and last time seen. Needs AuditLog.Read.All
    and Entra ID P1 or P2.
 4. -AdminCenterCsv: the CSV you export from Exchange admin center > Reports > Mail flow >
    SMTP AUTH clients report. It is the only source that shows Basic auth (TlsAuthLogin)
    versus OAuth (XOAUTH2).

It writes SmtpAuthSenders-<date>.csv and SmtpAuthSenders-<date>.html with a verdict per account.

Show more

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Script -Name Find-SmtpAuthSenders

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Copyright

(c) 2026 mailpassed.com. MIT License.

Package Details

Author(s)

  • mailpassed.com

Tags

SMTP SMTPAUTH ExchangeOnline Exchange Microsoft365 Office365 BasicAuth OAuth Printer ScanToEmail Report

Functions

Get-NormalizedAddress Get-EffectiveSmtpAuth Find-CsvColumn ConvertFrom-UsageReport ConvertFrom-SignIns ConvertFrom-AdminCenterCsv Get-Verdict Merge-SmtpAuthFindings ConvertTo-HtmlReport Invoke-Main

Dependencies

This script has no dependencies.

Release Notes

1.0.0 (25 Oct 2026): first release. Settings, 180-day usage report, sign-in IPs and the admin center CSV, with a verdict per account.

FileList

Version History

Version Downloads Last updated
1.0.0 (current version) 6 10/25/2026