rules/findings/m365/exchange_online/settings/ms-exo-smtp-auth-enabled.json
|
{
"args": [ ], "provider": "Microsoft365", "serviceType": "Exchange Online", "serviceName": "Microsoft 365", "displayName": "Ensure SMTP AUTH is disabled", "description": "This setting enables or disables authenticated client SMTP submission (SMTP AUTH) at an organization level in Exchange Online. The recommended state is Turn off SMTP AUTH protocol for your organization.", "rationale": "SMTP AUTH is a legacy protocol. Disabling it at the organization level supports the principle of least functionality and serves to further back additional controls that block legacy protocols, such as in Conditional Access. Virtually all modern email clients that connect to Exchange Online mailboxes in Microsoft 365 can do so without using SMTP AUTH.", "impact": "This enforces the default behavior, so no impact is expected unless the organization is using it globally. A per-mailbox setting exists that overrides the tenant-wide setting, allowing an individual mailbox SMTP AUTH capability for special cases.", "remediation": { "text": "\r\n\t\t\t###### To remediate using the UI: \r\n\t\t\t1. Navigate to Exchange admin center https://admin.exchange.microsoft.com. \r\n\t\t\t2. Select Settings \u003e Mail flow. \r\n\t\t\t3. Uncheck Turn off SMTP AUTH protocol for your organization. \r\n\t", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/authenticated-client-smtp-submission" ], "compliance": [ { "name": "CIS Microsoft 365 Foundations Benchmark", "version": "6.0.1", "reference": "6.5.4", "profile": [ "E5 Level 1", "E5 Level 1" ] } ], "level": "medium", "tags": [ "" ], "rule": { "path": "o365_exo_transport_config", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "SmtpClientAuthenticationDisabled", "eq", "false" ] ] } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "Guid": "Id", "Identity": "Identity", "OrganizationalUnitRoot": "OrganizationalUnitRoot", "SmtpClientAuthenticationDisabled": "SmtpClientAuthenticationDisabled", "InternalSMTPServers": "InternalSMTPServers" }, "expandObject": null }, "table": null, "decorate": [ ], "emphasis": [ ], "actions": { "objectData": { "properties": [ "*" ], "expandObject": null, "limit": null }, "showGoToButton": false, "showModalButton": false, "directLink": null } }, "text": { "data": { "properties": { "Guid": "Id", "Identity": "Identity", "OrganizationalUnitRoot": "OrganizationalUnitRoot", "SmtpClientAuthenticationDisabled": "SmtpClientAuthenticationDisabled", "InternalSMTPServers": "InternalSMTPServers" }, "expandObject": null }, "status": { "keyName": [ ], "message": "Ensure SMTP AUTH is disabled", "defaultMessage": "Ensure SMTP AUTH is disabled" }, "properties": { "resourceName": "Identity", "resourceId": "Guid", "resourceType": "EXOTransportConfig" }, "onlyStatus": false } }, "idSuffix": "m365_exo_smtp_auth_enabled", "notes": [ ], "categories": [ ], "immutable_properties": [ "Id", "Guid", "DistinguishedName" ], "id": "microsoft365_2129" } |