Back to Checks
m365

Direct Send is rejected for the Exchange Online organization

exchange_organization_reject_direct_send_enabled
Service: exchangeSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundariese3
Resource Type:NotDefined

The Exchange Online organization configuration should have RejectDirectSend enabled. Direct Send allows on-premises devices, applications, or third-party cloud services to send email to the tenant's hosted mailboxes using one of the tenant's accepted domains without authentication, which can be abused to spoof internal senders.

Prowler logoProwlerprowler-provider-m365

Risk

When Direct Send is allowed, anyone who knows a valid recipient and accepted domain can send unauthenticated email that appears to originate from inside the organization, enabling phishing and business email compromise against employees.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks exchange_organization_reject_direct_send_enabled

Recommendation

Enable RejectDirectSend so that unauthenticated Direct Send email to the tenant's accepted domains is rejected. Migrate any legitimate on-premises or application senders to authenticated connectors first.

Remediation

CLI

Set-OrganizationConfig -RejectDirectSend $true

Other

1Connect to Exchange Online PowerShell using Connect-ExchangeOnline
2Run: Set-OrganizationConfig -RejectDirectSend $true
3Ensure legitimate senders use an authenticated connector or SMTP AUTH before enabling

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.exchange.exchange_client import exchange_client


class exchange_organization_reject_direct_send_enabled(Check):
    """Check if Direct Send is rejected in the Exchange Online organization.

    Direct Send lets on-premises devices, applications, or third-party services
    send email to the tenant's hosted mailboxes using an accepted domain without
    authentication. Rejecting Direct Send reduces the risk of spoofed internal
    email.

    - PASS: RejectDirectSend is enabled for the organization.
    - FAIL: RejectDirectSend is disabled for the organization.
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for the Direct Send organization setting.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        organization_config = exchange_client.organization_config
        if organization_config:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=organization_config,
                resource_name=organization_config.name,
                resource_id=organization_config.guid,
            )
            report.status = "FAIL"
            report.status_extended = (
                "Direct Send is not rejected for the Exchange Online organization."
            )

            if organization_config.reject_direct_send:
                report.status = "PASS"
                report.status_extended = (
                    "Direct Send is rejected for the Exchange Online organization."
                )

            findings.append(report)

        return findings

References