MT.1062: Ensure Direct Send is set to be rejected
| ID | MT.1062 |
| Severity | Medium |
| Suite | Mito |
| Product | Exchange Online |
| Feature | Mail flow |
| Security area | Email and collaboration protection |
| Resource type | Tenant |
| User impact of fixing | Medium |
| Effort to fix | Medium |
| Framework controls | nist-800-53-r5:CM-7 Least Functionality |
| MITRE ATT&CK | T1566, T1684.002 |
| Reads from | Exchange Online |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Direct Send SHOULD be configured to Reject in Exchange Online
Rationale: Attackers can exploit direct send to send spam or phishing emails without authentication. Direct Send covers anonymous messages (unauthenticated messages) sent from your own domain to your organization’s mailboxes using the tenant MX.
Remediation action
Section titled “Remediation action”- Connect to Exchange Online:
Connect-ExchangeOnline- Configure the setting to reject direct send:
Set-OrganizationConfig -RejectDirectSend $true- Verify the policy:
(Get-OrganizationConfig).RejectDirectSendThe result should be True.
Related links
Section titled “Related links”- Introducing more control over Direct Send in Exchange Online
- Direct Send: Send mail directly from your device or application to Microsoft 365
Mito check. Author: bastienperez. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.