Description:
This check verifies that the native Exchange External Message setting is enabled in Exchange by ensuring that Set-ExternalInOutlook -Enabled is true.
The tag serves several purposes:
Security Awareness: The tag alerts users that an email originated from an external sender (someone outside the organization). It encourages caution and prompts recipients to double-check the email's legitimacy. Even with robust spam filters, user awareness remains essential in preventing spyware and malicious links.
Phishing Prevention: Despite measures like SPF, DKIM, and DMARC, some phishing and spam emails can still slip through. The external tag helps users identify potentially harmful messages and avoid clicking on suspicious links or attachments.
Visual Cue: When an email bears the "External" tag, it stands out visually. Users can quickly recognize that the sender is not part of their organization, prompting them to exercise caution.
Admin Tracking: For administrators, external tags assist in tracking and monitoring potentially risky emails. It helps identify patterns and assess security threats.
Why:
This check verifies that the native Exchange External Message setting is enabled in Exchange by ensuring that 'Set-ExternalInOutlook - Enabled' is true. This allows users to easily differentiate phishing messages originating from an external source. If your organization already uses mail flow rules (also known as transport rules) to add text to the subject line of messages from external senders, you should disable those rules before you enable this feature to avoid duplication.
Configured: This setting is in place.
Not Configured: This setting is not in place.
Scoring: Contributes up to 1 point to the Posture Recommendations score.
Category: General
Microsoft Licensing: Works with Basic licensing
Remediation in Augmentt: Configure directly in Augmentt (Configure tab)
Compliance Frameworks:
CISA SCuBA — MS.EXO.7.1
NIST CSF 2.0 — DE.CM-03
CIS Microsoft 365 Benchmark v6 (Level 1) — 6.2.3
CIS Microsoft 365 Benchmark v7 (Level 1) — 6.2.3
CMMC Level 1 — SC.L1-b.1.x
CMMC Level 2 — SC.L2-3.13.1
Microsoft documentation:
IMPORTANT:
After this setting is enabled, it can take between 24 and 48 hours for users to see the External icon in messages from external senders in supported versions of Outlook. If you decide to revert this setting, Exchange will also take 24 to 48 hours to stop tagging email messages from external senders, and any emails already tagged will not have their tags removed.