Direct Send is an unauthenticated email delivery method in Microsoft 365 and Exchange Online. It lets devices and applications send mail without user credentials, which is useful for legacy printers, scanners, or line-of-business systems that cannot sign in like a normal mailbox.
In cyber security, Direct Send matters because it weakens sender trust. If it is left enabled, attackers may abuse it to send messages that look internal, increasing the chance of phishing, business email compromise, or spoofed alerts. Defenders should treat it as a legacy exception: restrict it where possible, prefer authenticated SMTP submission or connector-based relay, and review whether controls such as RejectDirectSend, accepted domains, and inbound connectors are correctly configured. The goal is to ensure that only approved systems can send mail that appears to come from the tenant.