Back to Checks
m365

Organization has MailTips fully enabled

exchange_organization_mailtips_enabled
Service: exchangeSeverity: medium
OfficialBuilt-inVerified
Categories:email-securitye3
Resource Type:NotDefined

Microsoft 365 Exchange Online organization has MailTips fully configured: MailTipsAllTipsEnabled, MailTipsExternalRecipientsTipsEnabled, MailTipsGroupMetricsEnabled, and MailTipsLargeAudienceThreshold 25.

Prowler logoProwlerprowler-provider-m365

Risk

Absent or lax MailTips reduces user cues, increasing unintended external sends and large-audience blasts, harming confidentiality. Missing group metrics or high thresholds hide risky recipient counts; no OOF/full-mailbox tips cause misdelivery that enables phishing loops and data exfiltration.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks exchange_organization_mailtips_enabled

Recommendation

Apply defense in depth with consistent MailTips:

  • Enable external-recipient and group-metrics tips
  • Keep MailTipsLargeAudienceThreshold conservative (25)
  • Train users to heed tips before sending Pair with DLP and restricted forwarding to prevent accidental disclosure.

Remediation

CLI

Set-OrganizationConfig -MailTipsAllTipsEnabled $true -MailTipsExternalRecipientsTipsEnabled $true -MailTipsGroupMetricsEnabled $true -MailTipsLargeAudienceThreshold 25

Other

1Sign in to the Exchange admin center (admin.exchange.microsoft.com)
2Open Classic Exchange admin center > Organization > MailTips
3Enable: "Enable MailTips" (All tips)
4Enable: "External recipients MailTip"
5Enable: "Turn on group metrics for MailTips"
6Set "Large audience threshold" to 25 (or less)
7Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.exchange.exchange_client import exchange_client


class exchange_organization_mailtips_enabled(Check):
    """
    Check if MailTips are enabled for Exchange Online.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """
        Execute the check for MailTips in Exchange Online.

        This method checks if MailTips are enabled in the Exchange organization configuration.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        organization_config = exchange_client.organization_config
        if organization_config:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=organization_config,
                resource_name=organization_config.name,
                resource_id=organization_config.guid,
            )
            report.status = "FAIL"
            report.status_extended = (
                "MailTips are not fully enabled for Exchange Online."
            )

            if (
                organization_config.mailtips_enabled
                and organization_config.mailtips_external_recipient_enabled
                and organization_config.mailtips_group_metrics_enabled
                and organization_config.mailtips_large_audience_threshold
                <= exchange_client.audit_config.get(
                    "recommended_mailtips_large_audience_threshold", 25
                )
            ):
                report.status = "PASS"
                report.status_extended = (
                    "MailTips are fully enabled for Exchange Online."
                )

            findings.append(report)

        return findings

References