# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-MAIL-003
title: Tag messages from external senders in Outlook
finding:
  title: Outlook does not flag messages that come from outside the organization
  description: Users cannot tell at a glance that a message impersonating a colleague or a manager was in fact sent from outside.
status: active
profiles: [baseline]
risk:
  severity: low
assessment: manual
tags: [exchange-online, outlook, external-tag, phishing, user-awareness]

description: |
  The native external sender identification of Exchange Online is turned on
  (`Set-ExternalInOutlook -Enabled $true`). Outlook on the web, the new Outlook, Outlook for Mac and
  Outlook mobile show an **External** tag next to the sender and in the message list for mail that
  comes from outside the organization.

  The allow list of this feature (`AllowList`) only holds domains or addresses that belong to the
  organization but are sent through another tenant (subsidiaries, a former domain).
rationale: |
  Business email compromise and CEO fraud rely on a message that looks internal. A visible
  External tag gives users a simple cue that a "manager" writing from outside is suspicious. The
  native tag is preferred to a subject or body banner added by a mail flow rule: it does not alter
  the message, does not pile up in replies and does not break DKIM signatures on forwarded mail.
impact: |
  Users see a new tag; announce it with a short explanation. Classic Outlook for Windows shows the
  tag only in recent builds. If a mail flow rule already adds an "[EXTERNAL]" banner, remove it to
  avoid double marking.

audit:
  manual: |
    1. There is no portal page for this setting. Connect to Exchange Online PowerShell as at least a
       Global Reader.
    2. Run (read-only):
       ```powershell
       Get-ExternalInOutlook | Format-List Identity, Enabled, AllowList
       ```
    3. Check that `Enabled` is `True` and that `AllowList` only contains domains or addresses of the
       organization.
    4. Fail if `Enabled` is `False`, or if `AllowList` contains third-party domains.

remediation:
  manual: |
    1. Connect to Exchange Online PowerShell as an Exchange Administrator.
    2. Run:
       ```powershell
       Set-ExternalInOutlook -Enabled $true
       ```
    3. If needed, add internal domains hosted in another tenant:
       `Set-ExternalInOutlook -AllowList @{Add="subsidiary.example"}`.
    4. Allow up to 48 hours before the tag shows in every client.
  rollback: |
    `Set-ExternalInOutlook -Enabled $false`.

references:
  - title: Set-ExternalInOutlook
    url: https://learn.microsoft.com/powershell/module/exchangepowershell/set-externalinoutlook
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: CISA SCuBA Exchange Online baseline
    url: https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md
    publisher: CISA
    kind: standard
    accessed: 2026-10-24
  - title: ORCA - Office 365 Recommended Configuration Analyzer (check ORCA-240)
    url: https://github.com/cammurray/orca
    publisher: Microsoft (community project)
    kind: tool
    accessed: 2026-10-24
mappings:
  - framework: cis-m365
    framework_version: "7.0.0"
    id: "6.2.3"
    relation: equivalent
  - framework: cisa-scuba-m365
    framework_version: "2.0.0"
    id: MS.EXO.7.1v1
    relation: equivalent
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: SI-8
    relation: related
threats:
  - framework: mitre-attack
    id: T1566
related_controls:
  - id: CB-M365-MAIL-007
    type: related
  - id: CB-M365-MAIL-029
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24