Check ID:
Provider: Microsoft 365
Service:
Severity: MEDIUM
Categories:
Resource type:
exchange_external_email_tagging_enabledProvider: Microsoft 365
Service:
exchangeSeverity: MEDIUM
Categories:
email-security, e3Resource type:
NotDefinedWhat this check verifies
Microsoft 365 Exchange Online uses native external sender identification so supported Outlook clients display anExternal tag on messages originating outside the organization.
Risk
Without the native tag, users lose a clear signal that a message is from outside the tenant, increasing susceptibility to phishing, BEC, and credential theft. This raises risks to confidentiality (exfiltration) and integrity (fraudulent approvals) via social engineering and reply-chain attacks.Recommendation
Enable native external sender identification and prefer it over subject-line modifications. Apply defense in depth: enforce anti-phishing protections, validate senders with SPF/DKIM/DMARC, and deliver user training. Use exceptions sparingly for trusted domains to reduce noise while preserving least privilege in communication paths.Remediation
- CLI
- Dashboard steps
Set-ExternalInOutlook -Enabled $true
References
- https://techcommunity.microsoft.com/t5/exchange-team-blog/native-external-sender-callouts-on-email-in-outlook/ba-p/2250098
- https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-externalinoutlook?view=exchange-ps
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = exchange_external_email_tagging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks