How to disable Direct Send in Microsoft 365
Direct Send lets printers and apps email your own staff without signing in. Attackers use the same door to send fake "internal" emails, so Microsoft added a switch to close it.
Connect to Exchange Online PowerShell as an admin and run Set-OrganizationConfig -RejectDirectSend $true. Exchange Online then rejects unauthenticated Direct Send messages with error 550 5.7.68. Before you do, find any scanners, printers or apps that rely on Direct Send and move them to authenticated sending, or they will stop delivering.
What Direct Send is
Direct Send is a way to deliver email to mailboxes in your own Microsoft 365 organization without signing in. A device or app connects straight to your domain's Microsoft mail endpoint (your MX, something like yourdomain-com.mail.protection.outlook.com) and sends as any address on your domain. It only works for recipients inside your organization.
It was designed for things like multifunction printers that scan to email and older business apps that can't sign in.
Why turn it off
Because Direct Send needs no password, attackers can use it to send emails to your staff that look like they came from a colleague or from your own domain. Phishing campaigns abusing it were widely reported in 2025. If nothing in your organization depends on Direct Send, turning it off closes that gap.
Before you turn it off
- List what uses it. Check scanners, printers, line-of-business apps, website forms and alerting systems that send to internal staff.
- Move them to authenticated sending: SMTP client submission with a mailbox (
smtp.office365.com, port 587) or an SMTP relay through a partner connector in Exchange Online. - Check third-party services such as email security gateways that deliver to Microsoft 365. They should come in through a connector, not Direct Send.
Turn on Reject Direct Send
- Open PowerShell and connect with
Connect-ExchangeOnline, signing in as an Exchange or global administrator. - Run:
Set-OrganizationConfig -RejectDirectSend $true - Check it with:
Get-OrganizationConfig | Select-Object RejectDirectSend - Allow up to about 30 minutes for the change to apply.
To undo it, run Set-OrganizationConfig -RejectDirectSend $false.
What happens afterwards
Unauthenticated Direct Send messages are refused with the error 550 5.7.68. A device that still uses Direct Send won't show an obvious error to users: the message simply never arrives. Check device logs, and ask staff to report missing scans or alerts in the first few days. Look up other codes in the SMTP error code library.
Microsoft introduced this setting in April 2025 and has changed its defaults since. Check Microsoft's current documentation before you change it.
Questions people ask
- Will disabling Direct Send stop my printer from scanning to email?
- It will if the printer uses Direct Send. Move it to SMTP client submission with a mailbox, or to a relay connector, before you turn on Reject Direct Send.
- Does Reject Direct Send affect email from outside my organization?
- Normal email from other organizations is not affected. It only rejects unauthenticated messages that use your own domain through Direct Send.
- What error do blocked senders get?
- 550 5.7.68, meaning the message was rejected because Direct Send is turned off for the organization.
- Is there a setting in the admin center?
- The Microsoft announcement used PowerShell. Check Microsoft's current documentation, as admin center options change.