How to disable SMTP Authentication in Microsoft365

In most cases SMTP Auth is disabled by default in newer Microsoft365 tenants or those with security defaults enabled however some older 365 tenants may have SMTP Authentication enabled on some legacy accounts.

Most modern email clients no longer use SMTP to send and receive emails via M365 however it may still be enabled and posing a security risk to your organisation as SMTP is one of the most widely used attack surfaces by cyber criminals to breach passwords.

How to check if some user accounts use SMTP Auth

You can run a quick search on your Microsoft 365 tenant to see if any accounts have SMTP Auth enabled by following these steps in powershell.

Connect to ExchangOnline

Connect-ExchangeOnline

Now search for accounts with SMTP enabled.

Get-CASMailbox -ResultSize Unlimited |
    Where-Object { $_.SmtpClientAuthenticationDisabled -ne $true } |
    Select-Object DisplayName, PrimarySmtpAddress, SmtpClientAuthenticationDisabled

This will display a list of users with SMTP enabled.

Disable Authenticated SMTP for all users

You can automatically turn off SMTP for all the users listed by the CMDlet above by entering the following in PowerShell.

Get-CASMailbox -ResultSize Unlimited |
    Where-Object { $_.SmtpClientAuthenticationDisabled -ne $true } |
    ForEach-Object {
        Set-CASMailbox -Identity $_.PrimarySmtpAddress -SmtpClientAuthenticationDisabled $true
    }

You can also disable SMTP for your entire organisation using the following command.

Set-TransportConfig -SmtpClientAuthenticationDisabled $true

How do I know SMTP Auth is disabled?

Once you have turned off SMTP Auth for your organisation globally you can run the following command to check its status.

Get-TransportConfig | Format-List SmtpClientAuthenticationDisabled

Now run the following command to search individual accounts and make sure it returns no results.

Get-CASMailbox -ResultSize Unlimited | Where-Object { $_.SmtpClientAuthenticationDisabled -eq $false } | Select-Object DisplayName, PrimarySmtpAddress, SmtpClientAuthenticationDisabled

Liam Robinson

#EdTech Network Manager, experienced in Microsoft 365, Server 2019, Intune, SCCM and anything inbetween.