Direct Send Exposure

The question it answers: Can anyone on the internet deliver unauthenticated mail to the tenant that claims to come from its own domains?

Direct Send lets anything on the internet deliver mail to your tenant’s MX that claims to come from your own domain, with no authentication. Attackers use it for internal-looking phishing that SPF and DMARC do not stop reliably. RejectDirectSend closes it - once printers and apps that rely on it have a partner connector.

Note

The message-trace sample is a heuristic. An IP that is listed is sending mail as your domain from outside Microsoft without an inbound connector - usually a printer, a line-of-business app or a SaaS tool, sometimes an attacker.

At a glance

Where in the app	Exchange Online › Mail Security & Hygiene › Direct Send Exposure
Workload	Exchange Online
Kind	Findings list · dashboard tile
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	No extra licence needed.
Report id (API and MCP)	exchange.hygiene.direct-send

Columns

Column	Key	Type
Severity	Severity	Status
Item	Category	Text
Setting / IP / connector	Subject	Link
Check	Setting	Text
Value	Value	Text
Finding	Finding	Text
Senders / domains	Detail	Text
Date	When	Date
Messages	Number	Number

A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).

What it needs

Licence: No extra licence needed.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Exchange.ManageAsApp	Office 365 Exchange Online	Manage Exchange As Application	+ View-Only Configuration, Message Tracking

Data sources it reads

• Get-OrganizationConfig (RejectDirectSend)
• Get-InboundConnector
• Get-AcceptedDomain
• Get-MessageTraceV2 -SenderAddress *@domain (10 days, first 5 domains)

Through the API and MCP

GET /ir-api/v1/reports/exchange.hygiene.direct-send?size=100

An AI assistant reads it with the MCP tool get_report and the id exchange.hygiene.direct-send. The client needs the Read grant for Exchange Online. See Using the API.