Back to Checks
m365

SMTP AUTH is disabled in the Exchange Online Transport Configuration

exchange_transport_config_smtp_auth_disabled
Service: exchangeSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

Microsoft 365 Exchange Online transport configuration disables authenticated SMTP submission (SMTP AUTH) at the organization level

Prowler logoProwlerprowler-provider-m365

Risk

With SMTP AUTH enabled, attackers can:

  • Launch password spraying against mailboxes
  • Bypass MFA on SMTP submissions
  • Send unauthorized email, enabling internal spoofing and phishing

This undermines message integrity, aids lateral movement, and harms tenant reputation and deliverability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks exchange_transport_config_smtp_auth_disabled

Recommendation

Disable SMTP AUTH tenant-wide and allow per-mailbox exceptions only when justified, time-bound, and monitored. Prefer modern authentication and secure submission alternatives. Apply least privilege and defense in depth, restrict app access, rotate secrets, and monitor send patterns for anomalies.

Remediation

CLI

Set-TransportConfig -SmtpClientAuthenticationDisabled $true

Other

1Open the Exchange admin center: https://admin.exchange.microsoft.com
2Go to Settings > Mail flow
3Turn on "Turn off SMTP AUTH protocol for your organization"
4Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.exchange.exchange_client import exchange_client


class exchange_transport_config_smtp_auth_disabled(Check):
    """Check if SMTP AUTH is disabled in Exchange Online Transport Config.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the check for SMTP AUTH setting in Transport Config.

        This method checks if SMTP AUTH is disabled at the organization level in Exchange Online.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        transport_config = exchange_client.transport_config
        if transport_config:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=transport_config,
                resource_name="Transport Configuration",
                resource_id="transport_config",
            )
            report.status = "FAIL"
            report.status_extended = (
                "SMTP AUTH is enabled in the Exchange Online Transport Config."
            )

            if transport_config.smtp_auth_disabled:
                report.status = "PASS"
                report.status_extended = (
                    "SMTP AUTH is disabled in the Exchange Online Transport Config."
                )

            findings.append(report)

        return findings

References