Tag messages from external senders in Outlook

Description

The native external sender identification of Exchange Online is turned on (Set-ExternalInOutlook -Enabled $true). Outlook on the web, the new Outlook, Outlook for Mac and Outlook mobile show an External tag next to the sender and in the message list for mail that comes from outside the organization.

The allow list of this feature (AllowList) only holds domains or addresses that belong to the organization but are sent through another tenant (subsidiaries, a former domain).

Rationale

Business email compromise and CEO fraud rely on a message that looks internal. A visible External tag gives users a simple cue that a "manager" writing from outside is suspicious. The native tag is preferred to a subject or body banner added by a mail flow rule: it does not alter the message, does not pile up in replies and does not break DKIM signatures on forwarded mail.

Impact

Users see a new tag; announce it with a short explanation. Classic Outlook for Windows shows the tag only in recent builds. If a mail flow rule already adds an "[EXTERNAL]" banner, remove it to avoid double marking.

Audit

1. There is no portal page for this setting. Connect to Exchange Online PowerShell as at least a Global Reader.
2. Run (read-only):

   Get-ExternalInOutlook | Format-List Identity, Enabled, AllowList
   

3. Check that Enabled is True and that AllowList only contains domains or addresses of the organization.
4. Fail if Enabled is False, or if AllowList contains third-party domains.

Remediation

1. Connect to Exchange Online PowerShell as an Exchange Administrator.
2. Run:

   Set-ExternalInOutlook -Enabled $true
   

3. If needed, add internal domains hosted in another tenant: Set-ExternalInOutlook -AllowList @{Add="subsidiary.example"}.
4. Allow up to 48 hours before the tag shows in every client.

Rollback

Set-ExternalInOutlook -Enabled $false.

References

• Set-ExternalInOutlook Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Exchange Online baseline CISA, standard, accessed 2026-10-24
• ORCA - Office 365 Recommended Configuration Analyzer (check ORCA-240) Microsoft (community project), tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-007 Turn on MailTips, including external recipient warnings
• related CB-M365-MAIL-029 Configure anti-phishing impersonation protection, mailbox intelligence and safety tips

People and lifecycle