{
  "id": "CB-M365-MAIL-003",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-003",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-003.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-003.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-003",
    "title": "Tag messages from external senders in Outlook",
    "finding": {
      "title": "Outlook does not flag messages that come from outside the organization",
      "description": "Users cannot tell at a glance that a message impersonating a colleague or a manager was in fact sent from outside."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "exchange-online",
      "outlook",
      "external-tag",
      "phishing",
      "user-awareness"
    ],
    "description": "The native external sender identification of Exchange Online is turned on\n(`Set-ExternalInOutlook -Enabled $true`). Outlook on the web, the new Outlook, Outlook for Mac and\nOutlook mobile show an **External** tag next to the sender and in the message list for mail that\ncomes from outside the organization.\n\nThe allow list of this feature (`AllowList`) only holds domains or addresses that belong to the\norganization but are sent through another tenant (subsidiaries, a former domain).\n",
    "rationale": "Business email compromise and CEO fraud rely on a message that looks internal. A visible\nExternal tag gives users a simple cue that a \"manager\" writing from outside is suspicious. The\nnative tag is preferred to a subject or body banner added by a mail flow rule: it does not alter\nthe message, does not pile up in replies and does not break DKIM signatures on forwarded mail.\n",
    "impact": "Users see a new tag; announce it with a short explanation. Classic Outlook for Windows shows the\ntag only in recent builds. If a mail flow rule already adds an \"[EXTERNAL]\" banner, remove it to\navoid double marking.\n",
    "audit": {
      "manual": "1. There is no portal page for this setting. Connect to Exchange Online PowerShell as at least a\n   Global Reader.\n2. Run (read-only):\n   ```powershell\n   Get-ExternalInOutlook | Format-List Identity, Enabled, AllowList\n   ```\n3. Check that `Enabled` is `True` and that `AllowList` only contains domains or addresses of the\n   organization.\n4. Fail if `Enabled` is `False`, or if `AllowList` contains third-party domains.\n"
    },
    "remediation": {
      "manual": "1. Connect to Exchange Online PowerShell as an Exchange Administrator.\n2. Run:\n   ```powershell\n   Set-ExternalInOutlook -Enabled $true\n   ```\n3. If needed, add internal domains hosted in another tenant:\n   `Set-ExternalInOutlook -AllowList @{Add=\"subsidiary.example\"}`.\n4. Allow up to 48 hours before the tag shows in every client.\n",
      "rollback": "`Set-ExternalInOutlook -Enabled $false`.\n"
    },
    "references": [
      {
        "title": "Set-ExternalInOutlook",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/set-externalinoutlook",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Exchange Online baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      },
      {
        "title": "ORCA - Office 365 Recommended Configuration Analyzer (check ORCA-240)",
        "url": "https://github.com/cammurray/orca",
        "publisher": "Microsoft (community project)",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.EXO.7.1v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-8",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1566"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-007",
        "type": "related"
      },
      {
        "id": "CB-M365-MAIL-029",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}