Skip to content
MitoMito Docs

CISA.MS.EXO.7.1: External sender warnings SHALL be implemented.
ID CISA.MS.EXO.7.1
Severity Medium
Suite CISA SCuBA baselines
Product Exchange Online
Feature Mail flow
Security area Email and collaboration protection
Resource type Tenant
User impact of fixing Low
Effort to fix Low
Benchmark CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.EXO.7.1 (SHALL)
Framework controls cisa-scuba:MS.EXO.7.1
nist-800-53-r5:SI-8 Spam Protection
MITRE ATT&CK T1566
Reads from Exchange Online

What this checks and how to fix it

Section titled “What this checks and how to fix it”

External sender warnings SHALL be implemented.

Rationale: Phishing is an ever-present threat. Alerting users when email originates from outside their organization can encourage them to exercise increased caution, especially if an email is one they expected from an internal sender.

⚠️ WARNING: This test allows the use of a technical mechanism that differs from CISA’s, though the outcome is the same.

Remediation action:

Section titled “Remediation action:”
Option 1: Use external sender identification
Section titled “Option 1: Use external sender identification”

This feature is only available for Outlook, Outlook for Mac, Outlook on the web, and Outlook for iOS and Android.

  1. Connect to Exchange Online using PowerShell module ExchangeOnlineManagement
  2. Enable the feature with the cmdlet Set-ExternalInOutlook
Terminal window
Install-Module -Name ExchangeOnlineManagement
Connect-ExchangeOnline
Set-ExternalInOutlook -Enabled $true
Option 2: Prepend subject with “[External]”
Section titled “Option 2: Prepend subject with “[External]””

To create a mail flow rule to produce external sender warnings:

  1. Sign in to the Exchange admin center.
  2. Under Mail flow, select Rules.
  3. Click the plus (+) button to create a new rule.
  4. Select Modify messages….
  5. Give the rule an appropriate name.
  6. Under Apply this rule if…, select The sender is external/internal.
  7. Under select sender location, select Outside the organization, then click OK.
  8. Under Do the following…, select Prepend the subject of the message with….
  9. Under specify subject prefix, enter a message such as “[External]” (without the quotation marks), then click OK.
  10. Click Next.
  11. Under Choose a mode for this rule, select Enforce.
  12. Leave the Severity as Not Specified.
  13. Leave the Match sender address in message as Header and click Next.
  14. Click Finish and then Done.
  15. The new rule will be disabled. Re-select the new rule to show its settings and slide the Enable or disable rule slider to the right until it shows as Enabled.
Section titled “Related links”

Mito check, based on CISA ScubaGear. Author: soulemike; contributors: merill, f-bader. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.