What this check looks at
Checks that MailTips are on, including the warning for external recipients and large-audience tips, with the large-audience threshold at 25 or below.
MailTips are the information bars Outlook shows while someone is writing a message: a recipient is outside the organisation, a recipient is out of office, the group has 300 members, the mailbox is full, the address is invalid. They are controlled for the whole organisation in Exchange Online. By default most tips are on, but the external recipients tip is off.
The check reads the organisation configuration and fails when MailTips as a whole, the external recipients tip or group metrics (which lets Outlook count group members) are off, or when the large-audience threshold is above 25. It passes when all are on with a threshold of 25 or below, and warns when the threshold could not be read.
Misdirected email is one of the commonest data breaches: autocomplete picks the wrong Sarah, a reply-all goes to a customer distribution list, a salary spreadsheet goes to an outside address. MailTips cannot stop it, but they are the one prompt shown before the user presses Send, while the mistake is still reversible.
Why it matters
MailTips warn people before they send to someone outside, to a large list, or to someone who has left. They are the last chance to catch a misdirected email carrying personal data.
An HR adviser at a care provider means to send a disciplinary file to the company’s solicitor, and autocomplete picks a former colleague’s personal address instead. With the external recipients tip on, Outlook warns above the address that it is outside the organisation before she presses Send; without it, the first anyone knows is the recipient’s reply.
Email sent to the wrong person is among the incident types most often reported to the ICO, and where it carries sensitive personal data it can mean a reportable breach, complaints and regulatory attention. MailTips cost nothing and add one line to the compose window.
CIS Microsoft 365 Foundations Benchmark 6.5.2 asks for MailTips to be enabled for end users. NIST CSF 2.0 PR.AT-01 (personnel awareness), ISO 27001 A.5.14 (information transfer), CIS Controls v8 4.1 and the NCSC’s engagement and training guidance all support giving people the information to avoid mistakes.
How to fix it
Before you start
- Nothing to prepare.
Step by step
- Check the current settings. Connect with Connect-ExchangeOnline and run Get-OrganizationConfig | Format-List MailTipsAllTipsEnabled, MailTipsExternalRecipientsTipsEnabled, MailTipsGroupMetricsEnabled, MailTipsLargeAudienceThreshold. These settings are managed in Exchange Online PowerShell.
- Turn all the tips on. Run Set-OrganizationConfig -MailTipsAllTipsEnabled $true -MailTipsExternalRecipientsTipsEnabled $true -MailTipsGroupMetricsEnabled $true -MailTipsLargeAudienceThreshold 25. Use a lower threshold if the client wants a warning on smaller lists.
- Consider the External tag as well. The external recipients tip warns the sender; the separate External tag (Set-ExternalInOutlook -Enabled $true) marks incoming mail from outside. Both help people notice when a conversation leaves the organisation, and the External tag is covered by its own check.
- Tell users what they will see. Let people know that Outlook will now note when a message is going outside the organisation or to more than 25 people, and that the note is a prompt to check the recipients, not an error.
- Confirm the tips appear. Run the command from the first step again and check the three settings are True and the threshold is 25 or less. In Outlook on the web, start a message to an external address and check the external recipients tip appears; allow up to a day for the change to reach every client. The next assessment passes.
With PowerShell
Set-OrganizationConfig -MailTipsAllTipsEnabled $true -MailTipsExternalRecipientsTipsEnabled $true -MailTipsGroupMetricsEnabled $true -MailTipsLargeAudienceThreshold 25
What users will notice
Outlook shows a note when a message is going outside the organisation or to more than 25 people.
How to confirm it worked
Get-OrganizationConfig shows MailTipsAllTipsEnabled, MailTipsExternalRecipientsTipsEnabled and MailTipsGroupMetricsEnabled as True and MailTipsLargeAudienceThreshold 25 or less.
Frameworks and controls
This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.b Data in transit |
| DSPT | Standard 1: Personal confidential data |
| NIS2 | Art. 21(2)(g) Basic cyber hygiene practices and training |
| Zero Trust | Data |
| SOC 2 | CC6.7 Restricting the transmission, movement and removal of information |
| NIST SP 800-171 | 3.1.3 Control the flow of CUI in accordance with approved authorisations |
| CMMC Level 2 | AC.L2-3.1.3 Control CUI Flow |
| ISO 27001:2022 | A.5.14 Information transfer |
| CIS M365 | 6.5.2 Ensure MailTips are enabled for end users |
| CIS Controls v8.1 | 4.1 Establish and maintain a secure configuration process (IG1) |
| NIST CSF 2.0 | PR.AT-01: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind |
| NCSC 10 Steps | Engagement and trainingData security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- MailTips in Exchange Online (Microsoft Learn)