# (L1) Ensure email from external senders is identified

Outlook marks messages that come from outside the organisation with an External tag.

Source: https://maester.dev/docs/tests/CIS.M365.6.2.3

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Exchange Online · Outlook · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.6.2.3
```

## Overview

Outlook marks messages that come from outside the organisation with an External tag.

Phishing often impersonates a colleague, with a display name that matches an internal person. A clear External tag next to the sender tells the reader that the message is from outside and gives them a prompt to be careful before clicking a link or paying an invoice.

The feature works in Outlook for Windows, Mac, on the web and on mobile. CIS requires the allow list to contain only email addresses the organization has permitted to bypass external tagging. When external sender identification is enabled and the allow list is nonempty, this test reports **Investigate** so an administrator can confirm each address is approved; it cannot infer authorization from the address itself.

#### Remediation action

1. Connect to Exchange Online with `Connect-ExchangeOnline`.
2. Run `Get-ExternalInOutlook` and review every `AllowList` entry. Remove entries that are not explicitly approved by your organization.
3. Remove an unapproved entry with `Set-ExternalInOutlook -AllowList @{Remove='address@domain.com'}`, or replace the list with `Set-ExternalInOutlook -AllowList $ApprovedAddresses` after setting `$ApprovedAddresses` to the approved email addresses.
4. Run `Set-ExternalInOutlook -Enabled $true`.
5. Check the settings with `Get-ExternalInOutlook`.

#### Related links

* [Set-ExternalInOutlook](https://learn.microsoft.com/powershell/module/exchange/set-externalinoutlook)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.2.3](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.6.2.3 |
| Severity | Medium |
| Suite | CIS |
| Product | Exchange Online |
| Feature | Outlook |
| Area | Email and collaboration protection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566 Phishing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.2.3 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:6.2.3, nist-800-53-r5:SI-8 |
| PowerShell test | [Test-MtCisExternalSenderIdentification](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.2.3.ps1) |
| Services | ExchangeOnline |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.6.2.3.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.2.3.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.6.2.3.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.2.3.md)