Find-SmtpAuthExposure
1.0.0
Read-only. The script queries configuration and prints a report; it never
changes a setting, so it is safe to run against production before you have
decided anything.
The reason a script is needed rather than one Get-CASMailbox call is that
SmtpClientAuthenticationDisabled is tri-state, and the middle state is the
one that catches people out:
$true SMTP AUTH e
changes a setting, so it is safe to run against production before you have
decided anything.
The reason a script is needed rather than one Get-CASMailbox call is that
SmtpClientAuthenticationDisabled is tri-state, and the middle state is the
one that catches people out:
$true SMTP AUTH e
Read-only. The script queries configuration and prints a report; it never
changes a setting, so it is safe to run against production before you have
decided anything.
The reason a script is needed rather than one Get-CASMailbox call is that
SmtpClientAuthenticationDisabled is tri-state, and the middle state is the
one that catches people out:
$true SMTP AUTH explicitly blocked for this mailbox
$false SMTP AUTH explicitly allowed for this mailbox
$null inherit the tenant-wide setting
A mailbox showing $null looks harmless in a spreadsheet and is in fact
fully exposed whenever the tenant allows SMTP AUTH. Filtering only on
`-eq $false`, which is the usual advice, silently misses every one of them.
Show more
changes a setting, so it is safe to run against production before you have
decided anything.
The reason a script is needed rather than one Get-CASMailbox call is that
SmtpClientAuthenticationDisabled is tri-state, and the middle state is the
one that catches people out:
$true SMTP AUTH explicitly blocked for this mailbox
$false SMTP AUTH explicitly allowed for this mailbox
$null inherit the tenant-wide setting
A mailbox showing $null looks harmless in a spreadsheet and is in fact
fully exposed whenever the tenant allows SMTP AUTH. Filtering only on
`-eq $false`, which is the usual advice, silently misses every one of them.
Installation Options
Owners
Copyright
MIT
Package Details
Author(s)
- msgwing.com
Tags
SMTP SMTPAUTH BasicAuthentication ExchangeOnline Microsoft365 Office365 Audit ReadOnly Deprecation
Functions
Dependencies
This script has no dependencies.
Release Notes
Initial release. Reports which Exchange Online mailboxes can still authenticate
with SMTP AUTH before Microsoft disables Basic authentication for it by default
at the end of December 2026. Read-only.
Handles all three states of SmtpClientAuthenticationDisabled, including $null
which inherits the tenant setting - the state that the commonly repeated
`-eq $false` filter misses entirely.
FileList
- Find-SmtpAuthExposure.nuspec
- Find-SmtpAuthExposure.ps1
Version History
| Version | Downloads | Last updated |
|---|---|---|
| 1.0.1 | 4 | 8/27/2026 |
| 1.0.0 (current version) | 5 | 8/26/2026 |