Back to Checks
m365

Identity has external sender tagging enabled

exchange_external_email_tagging_enabled
Service: exchangeSeverity: medium
OfficialBuilt-inVerified
Categories:email-securitye3
Resource Type:NotDefined

Microsoft 365 Exchange Online uses native external sender identification so supported Outlook clients display an External tag on messages originating outside the organization.

Prowler logoProwlerprowler-provider-m365

Risk

Without the native tag, users lose a clear signal that a message is from outside the tenant, increasing susceptibility to phishing, BEC, and credential theft. This raises risks to confidentiality (exfiltration) and integrity (fraudulent approvals) via social engineering and reply-chain attacks.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks exchange_external_email_tagging_enabled

Recommendation

Enable native external sender identification and prefer it over subject-line modifications. Apply defense in depth: enforce anti-phishing protections, validate senders with SPF/DKIM/DMARC, and deliver user training. Use exceptions sparingly for trusted domains to reduce noise while preserving least privilege in communication paths.

Remediation

CLI

Set-ExternalInOutlook -Enabled $true

Other

1Sign in to the Exchange admin center: https://admin.exchange.microsoft.com
2Navigate to Mail flow > External tagging
3Turn on Enable external tagging in Outlook
4Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.exchange.exchange_client import exchange_client


class exchange_external_email_tagging_enabled(Check):
    """Ensure email from external senders is identified.

    This check verifies that the native "External" sender tag feature is enabled
    in Exchange so that messages from outside the organization are automatically marked.
    """

    def execute(self) -> List[CheckReportM365]:
        """Run the check to validate that external sender tagging is enabled.

        Iterates through the external mail configuration to determine if the
        ExternalInOutlook setting is turned on and generates a report accordingly.

        Returns:
            List[CheckReportM365]: A list of reports for each organization identity.
        """
        findings = []

        for mail_config in exchange_client.external_mail_config:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=mail_config,
                resource_name=mail_config.identity,
                resource_id=mail_config.identity,
            )
            report.status = "FAIL"
            report.status_extended = f"External sender tagging is disabled for Exchange identity {mail_config.identity}."

            if mail_config.external_mail_tag_enabled:
                report.status = "PASS"
                report.status_extended = f"External sender tagging is enabled for Exchange identity {mail_config.identity}."

            findings.append(report)

        return findings

References