MOERA SHOULD NOT be used for sent mail.
Why This Matters
Your Microsoft Online Entra Resource (MOERA) accounts should never be used to send email from your tenant. When a MOERA address appears in sent mail, it indicates a possible configuration error or compromise that could lead to unmonitored outbound messaging. Administrators must act quickly to investigate and block mail flow from MOERA accounts to prevent potential data leakage or abuse.
What Aether365 Checks
Aether365 scans all sent mail records in your Microsoft 365 tenant to verify that no messages originate from MOERA addresses. This check appears in the Aether365 dashboard under the microsoft-365 service category and flags any incident where a MOERA account is detected as a sender.
How to Fix
Follow these steps to remediate and prevent MOERA accounts from sending email: