{
  "id": "CB-M365-MAIL-007",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-007",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-007.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-007.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-007",
    "title": "Turn on MailTips, including external recipient warnings",
    "finding": {
      "title": "Outlook does not warn users before they send to external or large audiences",
      "description": "Users get no hint when a reply goes outside the organization or to a very large group, which leads to accidental disclosure."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "exchange-online",
      "outlook",
      "mailtips",
      "data-leakage",
      "user-awareness"
    ],
    "description": "MailTips are enabled for the organization with these settings:\n\n- `MailTipsAllTipsEnabled`: `$true`;\n- `MailTipsExternalRecipientsTipsEnabled`: `$true` (warning when a recipient is outside the\n  organization);\n- `MailTipsGroupMetricsEnabled`: `$true` (group size known to Outlook);\n- `MailTipsLargeAudienceThreshold`: at most {{ large_audience_threshold }} recipients.\n",
    "rationale": "MailTips show a banner while the user writes the message, before it is sent. The external\nrecipient tip catches the classic mistake of auto-completing a personal or partner address, and\nthe large audience tip catches replies to a whole distribution list. Both are cheap ways to reduce\naccidental data leaks.\n",
    "impact": "Users see more banners when writing to external or large audiences. No message is blocked.\n",
    "parameters": [
      {
        "name": "large_audience_threshold",
        "type": "integer",
        "description": "Number of recipients above which Outlook shows the large audience MailTip.",
        "unit": "recipients",
        "default": 25,
        "minimum": 1,
        "maximum": 1000
      }
    ],
    "audit": {
      "manual": "1. These settings are not shown in the admin centers. Connect to Exchange Online PowerShell as\n   at least a Global Reader.\n2. Run (read-only):\n   ```powershell\n   Get-OrganizationConfig | Format-List MailTips*\n   ```\n3. Fail if `MailTipsAllTipsEnabled`, `MailTipsExternalRecipientsTipsEnabled` or\n   `MailTipsGroupMetricsEnabled` is `False`, or if `MailTipsLargeAudienceThreshold` is greater\n   than {{ large_audience_threshold }}.\n"
    },
    "remediation": {
      "manual": "1. Connect to Exchange Online PowerShell as an Exchange Administrator.\n2. Run:\n   ```powershell\n   Set-OrganizationConfig -MailTipsAllTipsEnabled $true -MailTipsExternalRecipientsTipsEnabled $true `\n     -MailTipsGroupMetricsEnabled $true -MailTipsLargeAudienceThreshold 25\n   ```\n   Replace `25` with the chosen threshold.\n",
      "rollback": "`Set-OrganizationConfig -MailTipsExternalRecipientsTipsEnabled $false`.\n"
    },
    "references": [
      {
        "title": "MailTips in Exchange Online",
        "url": "https://learn.microsoft.com/exchange/clients-and-mobile-in-exchange-online/mailtips/mailtips",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-OrganizationConfig",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/set-organizationconfig",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Maester MT.1039",
        "url": "https://maester.dev/docs/tests/MT.1039",
        "publisher": "Maester",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-4",
        "relation": "related"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-003",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}