ScanRelay / Guides

Reject Direct Send in Microsoft 365: what it breaks for scanners, and how to fix it

Turning on RejectDirectSend closes a spoofing hole, and it's a CIS benchmark item. It also stops any printer that sends straight to your MX endpoint without logging in. Here's how to tell which devices that is, and how to keep them sending.

What the setting does

"Direct Send" is when a device or app connects to your tenant's MX endpoint (yourdomain-com.mail.protection.outlook.com) on port 25, without authenticating, and sends mail from an address in your own domain to your own mailboxes. Many scan-to-email setups use it because it needs no password and no licensed mailbox.

Attackers use the same path to send mail that looks like it came from inside your company. So Microsoft added an organization setting that rejects it:

Set-OrganizationConfig -RejectDirectSend $true

The setting is off by default. Microsoft says the change takes about 30 minutes to apply. Once it's on, unauthenticated Direct Send messages are rejected with:

550 5.7.68 TenantInboundAttribution; Direct Send not allowed for this organization from unauthorized sources

The CIS Microsoft 365 Foundations Benchmark (v6) includes it as control 6.5.5, "Ensure Direct Send submissions are rejected" (Level 2). If you or a client follow CIS, expect this switch to be flipped during a hardening pass.

Check before you turn it on

  1. See the current value: Get-OrganizationConfig | Select-Object RejectDirectSend
  2. List every printer, MFP and line-of-business app that sends mail. For each, note the SMTP server it uses.
  3. Any device pointed at *.mail.protection.outlook.com on port 25 with no login is using Direct Send. It will stop when the setting is on.
  4. Devices pointed at smtp.office365.com on port 587 use SMTP AUTH instead. Direct Send rejection doesn't affect them, but the Basic auth change does.
  5. Run a message trace for mail from your scanner addresses over the last week to catch anything you missed.

Your options for devices that used Direct Send

OptionWhat it needsTrade-offs
Partner inbound connectorA connector that recognizes the sender by static public IP or TLS certificateMicrosoft's named fix. Needs a static IP per site (or a certificate the device can present). One connector per site to keep up to date.
Native OAuth on the deviceFirmware with Microsoft 365 OAuth support, plus an app registration or vendor consentBest when supported. Many older models never get it. See the brand guides.
A local relay that sends through Microsoft GraphA small container on the LAN and one sending mailboxWorks for any device that can send plain SMTP. No static IP, no connector, no DNS changes. One more box to run.
Scan to folder or cloudSMB share, SharePoint or OneDrive connector on the deviceAvoids email entirely, but changes how staff work.

How a Graph relay fits

A relay like ScanRelay takes plain SMTP from the printer on your LAN and sends the message through Microsoft Graph as one mailbox you choose, using OAuth. That's an authenticated send from a real mailbox, not Direct Send, so RejectDirectSend doesn't apply to it. Messages reach internal and external recipients and show up in that mailbox's Sent Items.

  1. Deploy the relay (Docker or LXC) and connect it to a sending mailbox. The README covers the app registration and RBAC for Applications scoping.
  2. Add each device's IP to SCANRELAY_ALLOW_IPS, or give it a login in SCANRELAY_USERS.
  3. On each device, change the SMTP server from *.mail.protection.outlook.com to the relay's LAN address, port 25, no TLS unless you gave the relay a certificate.
  4. Send a test scan to an internal and an external address, then turn on RejectDirectSend and test again.

Rolling back: if something you missed stops sending, Set-OrganizationConfig -RejectDirectSend $false turns Direct Send back on while you fix it.

Lock down Direct Send without breaking scan-to-email

ScanRelay takes plain SMTP from devices on your LAN and sends it as your own mailbox through Microsoft Graph with OAuth. It's open source and self-hostable. The hosted relay and MSP dashboard are in beta from October 2026.

Join the betaView on GitHub

Sources

  1. Microsoft 365 Message Center MC1093237: New Reject Direct Send parameter
  2. Petri: Exchange Online adds new control to enhance email protection
  3. CIS Microsoft 365 Foundations v6.0.1, 6.5.5 (L2): Ensure Direct Send submissions are rejected
  4. ScanRelay on GitHub