CIS.M365.6.2.3 - (L1) Ensure email from external senders is identified

Contributed by jeremy finneyAll contributors →

Overview

Outlook marks messages that come from outside the organisation with an External tag.

Phishing often impersonates a colleague, with a display name that matches an internal person. A clear External tag next to the sender tells the reader that the message is from outside and gives them a prompt to be careful before clicking a link or paying an invoice.

The feature works in Outlook for Windows, Mac, on the web and on mobile. CIS requires the allow list to contain only email addresses the organization has permitted to bypass external tagging. When external sender identification is enabled and the allow list is nonempty, this test reports Investigate so an administrator can confirm each address is approved; it cannot infer authorization from the address itself.

Remediation action

1. Connect to Exchange Online with Connect-ExchangeOnline.
2. Run Get-ExternalInOutlook and review every AllowList entry. Remove entries that are not explicitly approved by your organization.
3. Remove an unapproved entry with Set-ExternalInOutlook -AllowList @{Remove='address@domain.com'}, or replace the list with Set-ExternalInOutlook -AllowList $ApprovedAddresses after setting $ApprovedAddresses to the approved email addresses.
4. Run Set-ExternalInOutlook -Enabled $true.
5. Check the settings with Get-ExternalInOutlook.

Related links

• Set-ExternalInOutlook
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.2.3

Test Metadata

Field	Value
Test ID	CIS.M365.6.2.3
Severity	Medium
Suite	CIS
Product	Exchange Online
Feature	Outlook
Area	Email and collaboration protection
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1566 Phishing
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.2.3
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:6.2.3, nist-800-53-r5:SI-8
PowerShell test	Test-MtCisExternalSenderIdentification
Services	ExchangeOnline

Source

• Test: tests/cis/Test.CIS.M365.6.2.3.ps1
• Documentation: tests/cis/Test.CIS.M365.6.2.3.md