M365EXO-020: SMTP AUTH disabled organization-wide (MS.EXO.5.1)
- Platform
- Entra ID / M365
- Category
- Advanced Threat Protection
- Severity
- High
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
SCuBA MS.EXO.5.1 requires that SMTP AUTH be disabled. SMTP AUTH is a legacy submission protocol that authenticates with username and password and cannot enforce multi-factor authentication. Leaving it enabled as the tenant default gives attackers a path to send mail using stolen credentials while bypassing MFA and Conditional Access.
Recommended value
SMTP AUTH disabled as the organization default (SmtpClientAuthenticationDisabled = True), with per-mailbox exceptions only for documented service accounts
Remediation
Disable SMTP AUTH as the global default by setting SmtpClientAuthenticationDisabled to True on the transport configuration. Where a specific service account genuinely requires SMTP AUTH, enable it only on that individual mailbox and document the justification. Monitor sign-in telemetry for SMTP AUTH usage and migrate legacy applications to modern authentication.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- CISA SCuBA
- MS.EXO.5.1v1
- NIST SP 800-53
- IA-2
- MITRE ATT&CK
- T1078, T1110