How to find distribution groups open to external senders

Before you start

Use an account in the Organization Management or Recipient Management role group, which Microsoft lists for distribution groups. Microsoft says members of View-Only Organization Management can view the configuration of those features. The example uses the ExchangeOnlineManagement module and asks for no Microsoft Graph permission.

Know the settings. Microsoft's default is to allow messages only from people inside the organisation. Allowing people inside and outside opens the group to anyone, including people on the internet, though a list of specified senders still limits who gets through and moderation holds messages for approval. The examples read and export; they change no group.

Option 1

Find groups open to external senders with PowerShell

Install the module once, then connect and export the groups that accept mail from outside. The filter runs in Exchange Online, so only those groups come back.

# Install once, if the module is not already installed.
Install-Module ExchangeOnlineManagement -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-ExchangeOnline
try {
    $filter = 'RequireAllSendersAreAuthenticated -eq $false'
    $groups = @(Get-DistributionGroup -ResultSize Unlimited -Filter $filter)
    $report = @(foreach ($group in $groups) {
        [pscustomobject]@{
            Name = $group.DisplayName
            Address = $group.PrimarySmtpAddress
            Type = $group.RecipientTypeDetails
            Owners = ($group.ManagedBy -join '; ')
            Moderated = $group.ModerationEnabled
            OnlyAcceptsFrom = ($group.AcceptMessagesOnlyFromSendersOrMembers -join '; ')
            HiddenFromAddressLists = $group.HiddenFromAddressListsEnabled
        }
    })
    if ($report.Count -eq 0) {
        Write-Output 'Every distribution group accepts mail from inside the organisation only.'
    } else {
        $report | Sort-Object Type, Name |
            Export-Csv -Path './groups-open-to-external.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) groups accept mail from outside the organisation."
    }
} finally {
    Disconnect-ExchangeOnline -Confirm:$false
}

The CSV has 1 row per open group. A group with names in OnlyAcceptsFrom takes mail only from those senders, and a moderated group holds each message for a moderator first, so those rows are less exposed than the rest. To narrow the export to distribution lists, add -RecipientTypeDetails MailUniversalDistributionGroup to Get-DistributionGroup.

Check dynamic distribution groups too

Reconnect with Connect-ExchangeOnline, then run the same filter against dynamic distribution groups, which Get-DistributionGroup leaves out.

# Run while connected to Exchange Online.
$filter = 'RequireAllSendersAreAuthenticated -eq $false'
Get-DynamicDistributionGroup -ResultSize Unlimited -Filter $filter |
    Select-Object DisplayName, PrimarySmtpAddress, RecipientFilter

Option 2

Check delivery management in the admin centre

1. Sign in to the Exchange admin centre for the correct tenant.
2. Go to Recipients > Groups > Distribution list. Mail-enabled security groups are on the Mail-enabled security tab.
3. Select the group by clicking anywhere in its row, then open the Settings tab.
4. Read Delivery management. Only allow messages from people inside my organization is the default; Allow messages from people inside and outside my organization opens the group to anyone.
5. Close the group without choosing Save, so nothing changes.

This suits checking 1 group. Each group opens on its own, so for a list of every open group in the tenant, use PowerShell or a report.

Common questions

Why does a filter on RequireSenderAuthenticationEnabled fail?

That is the name the setting shows in the output, not the one the filter reads. Microsoft says to use RequireAllSendersAreAuthenticated in the filter, as the script does, with the filter in single quotation marks because it contains $false.

Why is mail from a contact rejected by a group?

A mail contact counts as an outside sender. Microsoft says that when a group allows only people inside the organisation, mail from a mail contact is rejected even if the contact is in the group's specified senders list.

Who receives mail sent to an open group?

Every member, outside members included. To list the members of each group, see how to export distribution group members in Exchange Online.