The SMTP AUTH protocol is used to submit millions of emails every day. The majority of the clients connecting to Exchange Online like this are devices such as multi-function printers or some piece of software that send automated emails. Email clients such as Outlook rarely use this protocol anymore and instead make use of other protocols secured with Modern Authentication (OAuth).
SMTP AUTH (also known as authenticated SMTP client submission) is a legacy internet protocol which does not support OAuth by design. All clients have ever needed to send messages was a username and password, and these credentials are all too often obtained and used by attackers. As we have previously indicated we are working on adding support for OAuth with SMTP AUTH, but we also know that many clients have yet to add support for OAuth. For that reason Basic Authentication will need to be supported in Exchange Online for the foreseeable future, though it is still very wise to turn off SMTP AUTH in Office 365 tenants when possible.
We previously added a setting to make it possible for tenants to disable SMTP AUTH for their entire organization. Additionally, we ensured that each mailbox has a setting to override the tenant setting and enable SMTP AUTH. These two settings will provide administrators with the granularity required to allow most mailboxes to have SMTP AUTH disabled, and a few select mailboxes to have it enabled. You can find out more about these settings here.
To reduce what attackers can do with compromised user credentials, we are also taking steps to disable SMTP AUTH by default in Exchange Online. Firstly we have already started rolling out a change to disable it for new Office 365 tenants. This means Exchange administrators of newly created tenants will need to enable SMTP AUTH for any mailbox that requires it, using the per-mailbox setting we provide.
The next step will be to disable SMTP AUTH for existing tenants who do not make use of the SMTP AUTH protocol for sending any messages. Affected customers will receive targeted Message Center posts if they are affected by this in the next few months. Finally, the last group of customers are those who have some mailboxes using SMTP AUTH. We will work to have the disable setting for their tenant set while enabling the mailbox setting to continue their usage of SMTP AUTH. There is no ETA yet for this work.
Exchange administrators are free to take proactive steps to disable SMTP AUTH for all mailboxes that do not require it. Customers with on-premises Exchange servers can also disable SMTP AUTH for all their hosted mailboxes and, instead, only allow sending using SMTP AUTH for those on-premises servers when the device or client is on their own network. This blocks attackers on the internet from trying to use Exchange Online to send from one of your hosted mailboxes.
Note: New tenant administrators should note that Security Defaults may also be turned on for their organization. This policy enforces a higher default security configuration and includes enforcing multi-factor authentication and disabling basic authentication for the entire tenant. As it does not allow exceptions, it is not an option for organizations that need to use SMTP AUTH for a few mailboxes. You can find out more about Security Defaults and how to disable it, if necessary, here.
We hope you found this update useful, please feel free to leave comments and feedback below.
Sean Stevenson
