Direct Send

This setting controls whether Direct Send is enabled for your organization. Direct Send allows internal servers and applications to send email through Exchange Online without authentication. Disabling Direct Send helps reduce the risk of unauthorized email relay and improves email security by requiring proper authentication.

Settings this baseline controls

Setting	What it does
Direct Send blocked	Controls whether Direct Send is rejected. When true, unauthenticated email relay from internal servers and devices is blocked. Learn more

Adding a baselineAdd, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.→

Configure it

This baseline blocks Direct Send: internal servers, printers and applications relaying mail through Exchange Online without authenticating.

1. Add the baseline.

   Add it to the tenant directly (see Adding a baseline), or deploy it as part of a scheme (see Deploying a scheme).

2. Turn on Direct Send blocked.

   Set Direct Send blocked on. This stops internal servers, printers, scanners and line-of-business applications relaying mail through Exchange Online’s default endpoint without authenticating first.

3. Check what still relies on Direct Send.

   Direct Send is normally used by devices that can’t authenticate: multifunction printers, scan-to-email, and monitoring and alerting tools. Move anything still using it to authenticated SMTP client submission, or a licensed mailbox, before you enforce this.

4. Save.

   Turn on Auto-remediation if you want Octiga to turn this back on whenever it’s changed (see Remediation). Users don’t notice it; it only affects devices and applications sending mail on the tenant’s behalf.

Caution

Any printer, scanner or application still configured to send mail directly to the tenant’s mail endpoint without authenticating stops being able to send as soon as this is enforced. Confirm nothing still depends on Direct Send before turning it on, and see Troubleshooting if mail stops flowing afterwards.

Check it worked

Passing means the tenant’s organisation configuration has Direct Send rejected. Microsoft has no admin-centre toggle for this setting, so confirm it in Exchange Online PowerShell with Get-OrganizationConfig | Format-List RejectDirectSend, or in Octiga’s own baseline table. Users notice nothing directly; mail from a device or application still relying on Direct Send bounces instead.

Standards this addresses

CISM365 6.5.xv8 4.8

NISTPR.PT-1SC-8AC-17

ISO 27001A.8.23A.8.24

Doing this for every tenant?

Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.

Deploying a scheme→