# Direct Send

> This setting controls whether Direct Send is enabled for your organization.

This setting controls whether Direct Send is enabled for your organization. Direct Send allows internal servers and applications to send email through Exchange Online without authentication. Disabling Direct Send helps reduce the risk of unauthorized email relay and improves email security by requiring proper authentication.

## Settings this baseline controls

| Setting             | What it does                                                                                                                                                                                                                               |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Direct Send blocked | Controls whether Direct Send is rejected. When true, unauthenticated email relay from internal servers and devices is blocked. [Learn more](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-organizationconfig) |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline blocks Direct Send: internal servers, printers and applications relaying mail through Exchange Online without authenticating.

1. **Add the baseline.** Add it to the tenant directly (see [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or deploy it as part of a scheme (see [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. **Turn on Direct Send blocked.** Set **Direct Send blocked** on. This stops internal servers, printers, scanners and line-of-business applications relaying mail through Exchange Online's default endpoint without authenticating first.
3. **Check what still relies on Direct Send.** Direct Send is normally used by devices that can't authenticate: multifunction printers, scan-to-email, and monitoring and alerting tools. Move anything still using it to authenticated SMTP client submission, or a licensed mailbox, before you enforce this.
4. **Save.** Turn on **Auto-remediation** if you want Octiga to turn this back on whenever it's changed (see [Remediation](https://docs.octiga.io/baselines/remediation/)). Users don't notice it; it only affects devices and applications sending mail on the tenant's behalf.

> **Caution:** Any printer, scanner or application still configured to send mail directly to the tenant's mail endpoint without authenticating stops being able to send as soon as this is enforced. Confirm nothing still depends on Direct Send before turning it on, and see [Troubleshooting](https://docs.octiga.io/reference/troubleshooting/) if mail stops flowing afterwards.

## Check it worked

Passing means the tenant's organisation configuration has Direct Send rejected. Microsoft has no admin-centre toggle for this setting, so confirm it in Exchange Online PowerShell with `Get-OrganizationConfig | Format-List RejectDirectSend`, or in Octiga's own baseline table. Users notice nothing directly; mail from a device or application still relying on Direct Send bounces instead.

## Standards this addresses

### CIS

- **M365 6.5.x** — CIS M365 Foundations Benchmark 6.5.x
- **v8 4.8** — CIS Controls v8 Safeguard 4.8

### NIST

- **PR.PT-1** — NIST CSF 2.0 PR.PT-1
- **SC-8** — NIST SP 800-53 SC-8
- **AC-17** — NIST SP 800-53 AC-17

### ISO 27001

- **A.8.23** — ISO/IEC 27001:2022 Annex A.8.23
- **A.8.24** — ISO/IEC 27001:2022 Annex A.8.24

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)