Direct Send is a Microsoft 365 sending method for devices or applications that submit mail directly to the organization's mail endpoint. Microsoft describes it as unauthenticated mail from an external email server. That makes route attribution important: do not infer a trusted device merely because a message uses an internal-looking From address.
Distinguish the supported methods
Microsoft’s current comparison includes client SMTP submission, SMTP relay, Direct Send and High Volume Email. Their authentication and recipient scopes differ; this investigation focuses on Direct Send. Microsoft describes SMTP relay as using an inbound connector, while Direct Send is unauthenticated and cannot relay to external recipients through Microsoft 365. Direct Send messages are treated like anonymous internet mail with scanning and protections applying. Microsoft sending-method guidance.
An internal recipient and port 25 are clues, not conclusive proof of a specific device or configuration. A legitimate external sender can also deliver mail to that recipient. Avoid calling the route an open relay merely because inbound mail was accepted. Check what the service accepted, which recipient scope was involved and what trusted evidence identifies the path.
Collect route-specific evidence
Ask an authorized administrator to preserve the original message and inspect message trace for the relevant sender, recipient and time window. Trace records support investigation of receipt, processing and delivery; their fields should be correlated with the original rather than treated as proof of business intent. Microsoft message trace documentation.
Record trusted authentication results, source details available to the receiver, connector or rule involvement where observable and the final action. Review configured devices and applications with their owners. A source IP alone may identify an egress point shared by several systems. Preserve unknowns if the available trace or headers do not establish the responsible application.
Avoid the wrong remediation
Do not add an unknown source to SPF just to make a suspicious message authenticate. SPF authorization is a security decision about an intended sender. Do not create a broad connector or allow rule based solely on a display name or From address. DMARC alignment and content safety remain separate questions even for mail delivered to an internal mailbox. RFC 9989.
Microsoft's documentation warns that Direct Send requires careful administration and recommends considering other supported methods where suitable. Product defaults and controls can change; verify the tenant's current settings and current Microsoft guidance before applying a change. This guide does not claim a universally enabled or disabled Direct Send setting across tenants.
Read the bounded investigation example
In written case DEMO-DIRECT-01, assume visible From scanner@brand.test and recipient operations@brand.test in the organization. The connecting IP, actual envelope identity and DKIM signing domains are not supplied. Anonymous inbound delivery is a hypothesis, not an observed trace finding. It deliberately records trace not queried, connector unknown and trusted authentication not exported. Its result is Direct Send hypothesis, not confirmed. The case therefore requests an authorized receiver export and inventory correlation before attributing the message to a scanner or declaring a connector compromised.
No Microsoft tenant was accessed, no message was sent and no route was blocked. After a real evidence review, make any change through the responsible mail owner's process. Test legitimate device mail and the intended protection, document rollback and verify the observed result. Closing a route blindly may interrupt alerts while leaving the original abuse mechanism untouched.
Set a bounded evidence request
The proposed mail owner requests an authorized trace for the incident time and recipient, preserving the query timezone and report type. The device owner then compares the observed route with approved device settings. Until those records exist, leave source attribution and connector involvement unknown. Do not broaden permissions just to obtain a more convenient report; use the least-privileged authorized role. No tenant default is inferred from this example.