General

Outlook has functionality to provide emails from external senders with a visible label and warning message. This feature is disabled by default.

Rationale

By labeling emails from external senders, users are helped to recognize the origin of a message. This enables them to be extra cautious and better recognize spam and phishing emails.

Attic Fix

A fix is available for this check! It will be offered via a ticket in Attic which you can then accept.

Manual Instruction

Follow these steps to adjust the setting using PowerShell:

1. Connect to Exchange Online with Connect-ExchangeOnline
2. Execute the following command:

Set-ExternalInOutlook -Enabled $true

Impact

This functionality only works in Outlook. Other email programs or apps may not display the feature.

Emails that were already present in the mailbox will not be retroactively labeled. It only concerns new emails received after the feature is enabled.

Any Mailflow rules that also provide external messages with a disclaimer or part in the subject must be disabled to prevent double labeling.

In Outlook, users on different systems will see the following features appear (this can take 24-48 hours after activation of the feature):

CIS Mapping

• CIS Item: 6.2.3 (L1) Ensure email from external senders is identified
  
• Profile: E3 Level 1
  

More Information

1. https://techcommunity.microsoft.com/t5/exchange-team-blog/native-external-sender-callouts-on-email-in-outlook/ba-p/2250098
2. https://learn.microsoft.com/en-us/powershell/module/exchange/set-externalinoutlook?view=exchange-ps