Check ID:
Provider: Microsoft 365
Service:
Severity: MEDIUM
Categories:
Resource type:
exchange_organization_mailtips_enabledProvider: Microsoft 365
Service:
exchangeSeverity: MEDIUM
Categories:
email-security, e3Resource type:
NotDefinedWhat this check verifies
Microsoft 365 Exchange Online organization has MailTips fully configured:MailTipsAllTipsEnabled, MailTipsExternalRecipientsTipsEnabled, MailTipsGroupMetricsEnabled, and MailTipsLargeAudienceThreshold 25.
Risk
Absent or lax MailTips reduces user cues, increasing unintended external sends and large-audience blasts, harming confidentiality. Missing group metrics or high thresholds hide risky recipient counts; no OOF/full-mailbox tips cause misdelivery that enables phishing loops and data exfiltration.Recommendation
Apply defense in depth with consistent MailTips:- Enable external-recipient and group-metrics tips
- Keep
MailTipsLargeAudienceThresholdconservative (25) - Train users to heed tips before sending Pair with DLP and restricted forwarding to prevent accidental disclosure.
Remediation
- CLI
- Dashboard steps
Set-OrganizationConfig -MailTipsAllTipsEnabled true -MailTipsGroupMetricsEnabled $true -MailTipsLargeAudienceThreshold 25
References
- https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-organizationconfig?view=exchange-ps
- https://learn.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/mailtips/mailtips
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = exchange_organization_mailtips_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks