CIS.M365.6.5.2 - (L1) Ensure MailTips are enabled for end users
Overview
MailTips are enabled, including tips for external recipients and for large audiences.
MailTips show a short warning in the message while it is being written, for example that a recipient is outside the organisation or that the message goes to a large group. The warning prevents misdirected mail and gives the user a chance to stop a message that would leak data.
The test needs all MailTips on, the external recipient tip on, group metrics on and a large audience threshold greater than zero.
CIS does not prescribe one threshold for every organization: its PowerShell audit procedure asks administrators to verify an acceptable value and notes that 25 is the default. This check reports the configured value and only rejects an unset or nonpositive threshold; confirm that any other positive value is suitable for your organization.
Remediation action
- Connect to Exchange Online with
Connect-ExchangeOnline. - Run
Set-OrganizationConfig -MailTipsAllTipsEnabled $true -MailTipsExternalRecipientsTipsEnabled $true -MailTipsGroupMetricsEnabled $true -MailTipsLargeAudienceThreshold 25. - Check the settings with
Get-OrganizationConfig | Format-List MailTips*.
Related links
- MailTips in Exchange Online
- Set-OrganizationConfig
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.5.2
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.6.5.2 |
| Severity | Low |
| Suite | CIS |
| Product | Exchange Online |
| Feature | Outlook |
| Area | Email and collaboration protection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | None |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.5.2 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:6.5.2, nist-800-53-r5:AC-4 |
| PowerShell test | Test-MtCisMailTipsEnabled |
| Services | ExchangeOnline |
Source
- Test:
tests/cis/Test.CIS.M365.6.5.2.ps1 - Documentation:
tests/cis/Test.CIS.M365.6.5.2.md