Created by Claude - please verify

Direct Send - RejectDirectSend, inbound connectors and a 10-day message-trace sample (heuristic: our-domain mail from non-Microsoft IPs without a connector).

Required Microsoft Graph permissions

Exchange.ManageAsApp (+ View-Only Configuration, Message Tracking) — application permission, granted to the app registration with admin consent.

Licence: None.

Endpoints: Get-OrganizationConfig (RejectDirectSend) · Get-InboundConnector · Get-AcceptedDomain · Get-MessageTraceV2 -SenderAddress *@domain (10 days, first 5 domains)

The message-trace sample is a heuristic. An IP that is listed is sending mail as your domain from outside Microsoft without an inbound connector - usually a printer, a line-of-business app or a SaaS tool, sometimes an attacker.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Direct Send Exposure

Direct Send lets anything on the internet deliver mail to your tenant's MX that claims to come from your own domain, with no authentication. Attackers use it for internal-looking phishing that SPF and DMARC do not stop reliably. RejectDirectSend closes it - once printers and apps that rely on it have a partner connector.