What this check looks at
Checks, in Exchange Online, that Outlook tags mail from outside the organisation as External.
Outlook can show an External tag on messages from outside the organisation, in the message list and above the message, in Outlook on the web, the new Outlook for Windows, Outlook for Mac, Outlook mobile and current versions of classic Outlook. It is set organisation-wide in Exchange Online and is off by default.
This check reads the Exchange Online setting returned by Get-ExternalInOutlook. The check fails when the External tag is off.
Invoice fraud and chief-executive impersonation come from outside while pretending to be inside: a lookalike domain, the managing director’s name as the display name, or a free email account. In the reading pane they look just like internal mail. A consistent cue that the sender is external is the cheapest way to make people stop before acting on a payment request or a link.
Why it matters
Most invoice fraud and CEO-impersonation emails come from outside while pretending to be inside. A visible External tag is the cheapest way to make people pause before acting on one.
The finance assistant at a 35-person firm receives an email from “Sarah Jones, Managing Director” asking for an urgent supplier payment while she is in a meeting. It comes from a free email address carrying Sarah’s name. With an External tag on it the request stands out; without one, the payment goes out.
The tag costs nothing, needs no extra licence and is one command to turn on. It works best with a short explanation to staff of what it means.
CIS Microsoft 365 Foundations Benchmark 6.2.3 asks for email from external senders to be identified, and CISA SCuBA MS.EXO.7.1 asks for external sender warnings. ISO 27001 A.8.7 and A.5.14, the NCSC 10 Steps engagement and training guidance, the NCSC CAF secure configuration outcome and NIST CSF PR.AT-01 support it.
How to fix it
Before you start
- Tell users the External tag is coming and what it means, so it is read rather than ignored.
Step by step
- Connect to Exchange Online PowerShell. Install the ExchangeOnlineManagement module if needed (Install-Module ExchangeOnlineManagement) and run Connect-ExchangeOnline -UserPrincipalName <admin upn>.
- Check the current setting. Run Get-ExternalInOutlook and note whether Enabled is True or False and whether any AllowList entries exist.
- Turn the tag on. Run Set-ExternalInOutlook -Enabled $true. To exempt a trusted partner domain or address from the tag, add it with Set-ExternalInOutlook -AllowList @{Add="partner.co.uk"}, but keep the list short.
- Review any older subject-line rule. If the tenant already has a mail flow rule that adds [EXTERNAL] to the subject or a banner to the body (Exchange admin centre > Mail flow > Rules), decide whether to keep it; with both, people see two warnings. Many organisations remove the subject prefix because it clutters replies and search.
- Tell users what the tag means. Send a short note explaining the External tag, and that a message from the managing director that carries the tag did not come from the managing director’s mailbox.
- Confirm the tag appears. Run Get-ExternalInOutlook and check Enabled is True. Send a message from a personal address and check the tag shows in Outlook on the web; it can take up to 48 hours to reach every Outlook client. The finding clears at the next assessment.
With PowerShell
Set-ExternalInOutlook -Enabled $true
What users will notice
Outlook shows an External tag on messages from outside the organisation. It can take up to 48 hours to appear everywhere.
How to confirm it worked
Get-ExternalInOutlook shows Enabled as True; a test message from a personal address shows the tag.
Frameworks and controls
This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B4.b Secure configuration |
| DSPT | Standard 9: IT protection |
| NIS2 | Art. 21(2)(g) Basic cyber hygiene practices and training |
| Zero Trust | Applications |
| SOC 2 | CC6.8 Preventing or detecting unauthorised or malicious software |
| NIST SP 800-171 | 3.14.2 Provide protection from malicious code |
| CMMC Level 2 | SI.L2-3.14.2 Malicious Code Protection |
| ISO 27001:2022 | A.8.7 Protection against malwareA.5.14 Information transfer |
| CISA SCuBA | MS.EXO.7.1v1 External sender warnings implemented |
| CIS M365 | 6.2.3 Ensure email from external senders is identified |
| NIST CSF 2.0 | PR.AT-01: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind |
| NCSC 10 Steps | Engagement and training |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Native external sender callouts (Microsoft Tech Community)