Detections
Analytics

8.1.2 (L1) Ensure users can't send emails to a channel email address

Information

This setting controls whether Teams channels are allowed to receive emails sent to their unique email addresses. When enabled, emails sent to a channel's address will be delivered and appear in the channel's conversation thread; when disabled, the channel will reject incoming emails, preventing them from being posted.

The recommended state is Off.

Channel email addresses are not under the tenant's domain and organizations do not have control over the security settings for this email address. An attacker could email channels directly if they discover the channel email address.

Solution

To remediate using the UI:

 - Navigate to Microsoft Teams admin center https://admin.teams.microsoft.com.
 - Select Settings & policies > Global (Org-wide default) settings.
 - Click Teams to open the Teams settings section.
 - Under email integration set Users can send emails to a channel email address to Off.

To remediate using PowerShell:

 - Connect to Teams PowerShell using Connect-MicrosoftTeams.
 - Run the following command to set the recommended state:

Set-CsTeamsClientConfiguration -Identity Global -AllowEmailIntoChannel $false

Impact:

Depending on the organization's adoption, disabling this may disrupt workflows that rely on email-to-channel communication, particularly in environments where email is used to bridge external systems or vendors into Teams. This could include reduced visibility of important updates or alerts that were previously routed into Teams channels via email.

See Also

https://workbench.cisecurity.org/benchmarks/24619

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b.

Plugin: microsoft_azure

Control ID: 8c0a0999bc57315e4bdb1d29140e289021ba3c5d4129045d9b0b97f368495d19