Block or tightly restrict Direct Send in Microsoft 365 unless the business has a clear, documented need for it. Attackers abuse this email path because it can make a message appear to come from inside the company, even when it was sent without normal user authentication.
TLDR: Direct Send phishing happens when attackers send mail to Microsoft 365 through routes meant for printers, scanners, ticketing tools, and legacy apps. A fake message might claim to be from payroll@company.com and ask staff to open a “salary adjustment” file, while the real sender never signed in. In one midsize company, security teams found that 38% of suspicious “internal” payroll alerts came from unauthenticated mail flow, not employee accounts. The fastest fix is to audit Direct Send use, block unknown sources, and tighten Microsoft Defender for Office 365 policies.
What Direct Send Is
Direct Send is a Microsoft 365 mail feature often used by devices and applications that need to send email to internal recipients. Examples include printers sending scan-to-email messages, monitoring systems sending alerts, or older business apps sending workflow notices.
It exists because not every device supports modern authentication. A scanner in a warehouse may only know how to send basic SMTP mail. Direct Send lets that device send messages to the organization’s Microsoft 365 domain without using a licensed mailbox or full user sign-in.
The catch is that attackers like anything that skips normal login controls. If a mail route accepts messages for internal users without strong sender validation, a criminal may try to spoof an internal sender and push a fake invoice, password reset, HR notice, or document request.
How Attackers Abuse Direct Send
Direct Send phishing often starts with a simple idea: make external mail look internal. The attacker does not need to compromise an employee mailbox. Instead, the attacker sends a message that claims to be from a trusted internal address.
Common impersonation choices include:
- Executives: CEO, CFO, legal, or finance leaders.
- Shared mailboxes: payroll, HR, IT support, billing, or help desk.
- Automated systems: scanner, alerts, invoice processing, or ticketing tools.
- Project teams: procurement, operations, or vendor management.
The message may be short and urgent. That is part of the trick. It may say an invoice must be paid before noon, a mailbox will be closed, or a document must be reviewed. Honestly, it feels like these attacks are designed to exploit the five seconds before a busy employee notices something feels off.
Attackers also abuse weak allow lists. If a company has broad mail flow rules that trust entire IP ranges, domains, or old connectors, phishing mail can slip through with fewer warnings. Legacy exceptions become blind spots. The more exceptions a tenant has, the harder it becomes to tell good automated mail from fake internal mail.
Why Direct Send Phishing Is Hard to Spot
Direct Send phishing is tricky because the visible sender can look familiar. A user may see hr@company.com and assume the message is safe. The email may also land in the inbox without the obvious “external sender” warning if mail flow rules are weak or poorly ordered.
Another problem is trust fatigue. Employees see automated email all day. Password alerts, scan notifications, approval links, policy updates, and invoice reminders blur together. Attackers copy that format because it works.
Security teams also lose time when logs are messy. Expect to waste time on header reviews if devices, apps, and connectors were never named clearly. A scanner called “SMTP relay 3” tells investigators very little during an incident.
Signs of a Suspicious Direct Send Message
Users and security teams should treat these signs as warning flags:
- The sender looks internal, but the tone feels odd. The message may use unusual urgency or strange phrasing.
- The email asks for credentials. Internal tools should not ask users to re-enter passwords through unknown links.
- The link points outside the company. Hover text may show a domain that does not match the claimed service.
- The message contains unexpected attachments. Common lures include PDF, HTML, ZIP, and Office files.
- The email lacks a normal signature. Spoofed shared mailboxes often miss standard templates.
- The message arrives outside normal patterns. A payroll alert at 2:17 a.m. may need review.
Administrators should also inspect message headers. Suspicious mail may show signs such as anonymous authentication, weak sender alignment, odd originating IP addresses, or results that do not match normal internal systems. Header fields such as authentication results, connector data, and transport rule actions can help separate real device mail from spoofed mail.
How to Detect Direct Send Abuse in Microsoft 365
Detection should start with a baseline. Security teams need a list of approved systems that send mail without a user mailbox. That list should include the device name, owner, source IP, sending address, recipient pattern, and business reason.
Useful detection methods include:
- Message trace review: Search for internal-looking senders with unusual source IPs or delivery paths.
- Header analysis: Review authentication results and mail flow markers.
- Defender for Office 365 alerts: Monitor spoofing, phishing, malware, and unusual sender events.
- SIEM correlation: Compare suspicious email events with sign-in logs, endpoint alerts, and reported phishing.
- User reports: Encourage staff to report strange “internal” mail with the Microsoft Report Message add-in.
A practical rule is simple: if an email claims to be from an internal address, but it did not come from an approved internal source, it should be treated as suspicious.
How to Strengthen Microsoft 365 Email Security
The strongest defense is to reduce or remove unauthenticated sending paths. If Direct Send is not needed, the organization should block it where controls are available. If it is needed, it should be limited to known devices and reviewed often.
Recommended controls include:
- Inventory all Direct Send sources. Identify scanners, apps, servers, monitoring tools, and workflows that send mail.
- Replace Direct Send where possible. Use authenticated SMTP submission, Graph API, or a supported relay pattern for business apps.
- Use dedicated sender addresses. A scanner should not send as the CFO. Use clear addresses such as scanner.building3@company.com.
- Restrict trusted sources. Allow only known IP addresses or approved connectors where the design supports it.
- Enable SPF, DKIM, and DMARC. These do not solve every internal spoofing case, but they improve sender validation and reporting.
- Turn on anti-spoofing protection. Microsoft Defender for Office 365 can detect impersonation of users, domains, and protected senders.
- Use external sender tagging. Mail that is not truly internal should be labeled clearly.
- Review mail flow rules. Remove broad bypass rules that skip spam filtering, phishing checks, or attachment scanning.
- Protect high-risk users. Add executives, finance staff, HR, and IT admins to impersonation protection policies.
- Quarantine aggressive threats. High confidence phishing should not land in user inboxes.
Security teams should also run phishing simulations that include fake internal senders. This helps employees pause before trusting a familiar name. Training should be brief and realistic. Long annual slides rarely change behavior.
Operational Habits That Reduce Risk
Direct Send risk grows when no one owns the setup. Every mail-sending device should have a business owner. Every exception should expire or be reviewed on a schedule. Every shared mailbox used by automation should have a clear purpose.
Logs also matter. Microsoft 365 audit logs, Defender alerts, and message trace data should be kept long enough to support investigations. If legal, finance, or HR receives a suspicious message, investigators need more than a screenshot.
A good program also tests changes before rollout. Blocking Direct Send without an inventory can break scan-to-email, factory alerts, or service desk workflows. The safer path is to monitor, classify, restrict, and then block unknown traffic.
FAQ
What is Direct Send phishing?
Direct Send phishing is a spoofing attack that abuses Microsoft 365 mail paths meant for devices or apps. The attacker tries to make a message appear to come from an internal sender.
Does Direct Send mean an account was hacked?
Not always. In many cases, no mailbox password was stolen. The attacker may have spoofed the sender through an unauthenticated mail path.
Should every company disable Direct Send?
If the company does not need it, yes. If it is required, it should be restricted to approved systems and monitored closely.
Can SPF, DKIM, and DMARC stop all Direct Send phishing?
No. They help with sender validation, but internal spoofing and connector exceptions can still create gaps. They should be used with Defender policies, mail flow controls, and monitoring.
What should users do with a suspicious internal email?
They should not click links or open attachments. They should report the message through the approved phishing reporting tool or contact the security team.
Who should own Direct Send security?
Email administrators, security operations, and system owners should share responsibility. No device or app should send mail without a named owner and a documented reason.
