CIS.M365.6.2.3 - (L1) Ensure email from external senders is identified
Overview
Outlook marks messages that come from outside the organisation with an External tag.
Phishing often impersonates a colleague, with a display name that matches an internal person. A clear External tag next to the sender tells the reader that the message is from outside and gives them a prompt to be careful before clicking a link or paying an invoice.
The feature works in Outlook for Windows, Mac, on the web and on mobile. You can add trusted senders to an exception list, but the more entries it has, the fewer messages are tagged.
Remediation action
- Connect to Exchange Online with
Connect-ExchangeOnline. - Run
Set-ExternalInOutlook -Enabled $true. - Check the setting with
Get-ExternalInOutlook.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.6.2.3 |
| Severity | Medium |
| Suite | CIS |
| Product | Exchange Online |
| Feature | Outlook |
| Area | Email and collaboration protection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566 Phishing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.2.3 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:6.2.3, nist-800-53-r5:SI-8 |
| PowerShell test | Test-MtCisExternalSenderIdentification |
| Services | ExchangeOnline |
Source
- Test:
tests/cis/Test.CIS.M365.6.2.3.ps1 - Documentation:
tests/cis/Test.CIS.M365.6.2.3.md