CISA.MS.EXO.7.1 - External sender warnings SHALL be implemented.

Contributed by Michael Soule with 2 co-contributorsAll contributors →

Overview

External sender warnings SHALL be implemented.

Rationale: Phishing is an ever-present threat. Alerting users when email originates from outside their organization can encourage them to exercise increased caution, especially if an email is one they expected from an internal sender.

⚠️ WARNING: This test allows the use of a technical mechanism that differs from CISA's, though the outcome is the same.

Remediation action:

Option 1: Use external sender identification

This feature is only available for Outlook, Outlook for Mac, Outlook on the web, and Outlook for iOS and Android.

1. Connect to Exchange Online using PowerShell module ExchangeOnlineManagement
2. Enable the feature with the cmdlet Set-ExternalInOutlook

Install-Module -Name ExchangeOnlineManagement
Connect-ExchangeOnline
Set-ExternalInOutlook -Enabled $true

Option 2: Prepend subject with "[External]"

To create a mail flow rule to produce external sender warnings:

1. Sign in to the Exchange admin center.
2. Under Mail flow, select Rules.
3. Click the plus (+) button to create a new rule.
4. Select Modify messages….
5. Give the rule an appropriate name.
6. Under Apply this rule if…, select The sender is external/internal.
7. Under select sender location, select Outside the organization, then click OK.
8. Under Do the following…, select Prepend the subject of the message with….
9. Under specify subject prefix, enter a message such as "[External]" (without the quotation marks), then click OK.
10. Click Next.
11. Under Choose a mode for this rule, select Enforce.
12. Leave the Severity as Not Specified.
13. Leave the Match sender address in message as Header and click Next.
14. Click Finish and then Done.
15. The new rule will be disabled. Re-select the new rule to show its settings and slide the Enable or disable rule slider to the right until it shows as Enabled.

Related links

• Exchange admin center - Mail Flow Rules
• CISA 7 External Sender Warnings - MS.EXO.7.1v1
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.EXO.7.1
Severity	Medium
Suite	CISA
Product	Exchange Online
Feature	Mail flow
Area	Email and collaboration protection
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1566 Phishing
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.7.1
Criticality	SHALL
Upstream requirement	MS.EXO.7.1v1
Supports controls	cisa-scuba:MS.EXO.7.1, nist-800-53-r5:SI-8
PowerShell test	Test-MtCisaExternalSenderWarning
Services	ExchangeOnline

Source

• Test: tests/cisa/exchange/Test.CISA.MS.EXO.7.1.ps1
• Documentation: tests/cisa/exchange/Test.CISA.MS.EXO.7.1.md