CISA.MS.EXO.5.1: SMTP AUTH SHALL be disabled.
| ID | CISA.MS.EXO.5.1 |
| Severity | High |
| Suite | CISA SCuBA baselines |
| Product | Exchange Online |
| Feature | Client access |
| Security area | Authentication |
| Resource type | Tenant |
| User impact of fixing | Medium |
| Effort to fix | Medium |
| Benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.EXO.5.1 (SHALL) |
| Framework controls | cisa-scuba:MS.EXO.5.1nist-800-53-r5:CM-7 Least Functionality |
| Reads from | Exchange Online |
What this checks and how to fix it
Section titled “What this checks and how to fix it”SMTP AUTH SHALL be disabled.
Rationale: SMTP AUTH is not used or needed by modern email clients. Therefore, disabling it as the global default conforms to the principle of least functionality.
Remediation action:
Section titled “Remediation action:”- To disable SMTP AUTH for the organization:
- Sign in to the Exchange admin center.
- On the left hand pane, select Settings; then from the settings list, select Mail Flow.
- Make sure the setting Turn off SMTP AUTH protocol for your organization is checked.
Related links
Section titled “Related links”- Exchange admin center - Settings
- CISA 5 Simple Mail Transfer Protocol Authentication - MS.EXO.5.1v1
- CISA ScubaGear Rego Reference
Mito check, based on CISA ScubaGear. Author: soulemike; contributors: merill. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.