SMTP Access

This setting controls whether SMTP (Simple Mail Transfer Protocol) is enabled or disabled for your organization. Disabling SMTP helps reduce the risk of credential theft and spam by blocking a legacy protocol that does not support modern authentication or advanced security features.

Settings this baseline controls

Setting	What it does
SMTP authentication disabled	Controls whether authenticated SMTP is disabled for the organization. Learn more

Adding a baselineAdd, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.→

Configure it

This baseline turns off the legacy SMTP AUTH protocol across the organisation.

1. Add the baseline.

   Add it to the tenant directly (see Adding a baseline), or deploy it as part of a scheme (see Deploying a scheme).

2. Turn on SMTP authentication disabled.

   Set SMTP authentication disabled on for the whole organisation. This blocks the legacy SMTP AUTH protocol, which POP and IMAP clients use to send mail, as do some printers, scanners and line-of-business applications; none of them use modern authentication.

3. Exempt any mailbox that still needs it, in Microsoft 365 first.

   A per-mailbox setting takes precedence over the organisation-wide one, so an admin can re-enable SMTP AUTH for one mailbox in the Microsoft 365 admin centre without reopening it for everyone else.

4. Save.

   Turn on Auto-remediation if you want Octiga to turn this back on whenever it’s changed (see Remediation). Most people won’t notice; it only affects a device or application still trying to authenticate with SMTP AUTH.

Caution

Any client still sending mail through SMTP AUTH — an older printer or scanner, a monitoring tool, a POP or IMAP client — loses the ability to send as soon as this takes effect, with a 535 5.7.3 authentication error. Check which mailboxes currently have SMTP AUTH enabled before enforcing, and exempt them individually if they still need it.

Check it worked

Passing means SMTP AUTH is disabled tenant-wide. Check it in the Exchange admin centre, under Settings → Mail flow settings, where the toggle reads “Turn off SMTP AUTH protocol for your organization”. Users on modern clients (Outlook, Outlook on the web, mobile Outlook) notice nothing; a device or script still using SMTP AUTH gets an authentication failure instead of sending.

Standards this addresses

CISM365 6.5.4v8 4.8

NISTPR.PT-1SC-8AC-17

ISO 27001A.8.23A.8.24

Doing this for every tenant?

Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.

Deploying a scheme→