How to Add an External Email Warning in Microsoft 365

Connect to Exchange Online PowerShell and run:

Set-ExternalInOutlook -Enabled $true

That's it for the basic switch. Once enabled, Outlook (new Outlook for Windows, Outlook on the web, and Outlook mobile) adds a small "External" tag next to the sender's name on any message where the 5322.From address doesn't belong to your tenant's accepted domains. It shows up right in the message list and in the reading pane, which is exactly where someone staring at a fake invoice needs to see it.

You can confirm the current state with Get-ExternalInOutlook, and if you ever need to roll it back, Set-ExternalInOutlook -Enabled $false turns it off tenant-wide.

Here's where we see tenants trip themselves up. A lot of Microsoft 365 environments already have a transport rule from years ago that prepends "[EXTERNAL]" or "[CAUTION: External Sender]" to the subject line of inbound mail. If you turn on the native tag without disabling that rule, your staff ends up staring at a subject that reads "[EXTERNAL] [EXTERNAL] Invoice #4521" with a tag icon on top of it. It looks broken, people start ignoring both signals, and you've undone the whole point of the exercise.

Before you flip the switch, go find that old rule in the Exchange admin center under mail flow rules, or pull it with Get-TransportRule, and disable it:

Set-TransportRule -Identity "External Email Prefix" -Enabled $false

Don't delete it outright until you've confirmed the native tag is working the way you want. Disabling first, deleting later, gives you a rollback path if something in your mail flow depends on that subject text for a different reason, like an old Outlook rule someone set up to auto-file external mail.

This is the part that generates the most "did it break?" calls. After you run Set-ExternalInOutlook -Enabled $true, the setting doesn't show up instantly for every user. Microsoft's own documentation on the Set-ExternalInOutlook cmdlet notes that it can take a day or two to propagate across the service and down to client caches. Tell your staff ahead of time that the tag is coming but won't appear on everyone's screen the same afternoon. Otherwise you'll get a wave of "it's not working for me" tickets from people who checked five minutes after you made the change, and someone on your IT team will burn an afternoon chasing a non-issue.

If you're managing this yourself without dedicated Microsoft 365 management, this lag is a common reason rollouts get abandoned halfway through. We handle this exact kind of change as part of Exchange administration for clients across Texas, specifically because small configuration details like propagation timing trip up well-meaning IT generalists.

Once the tag is live, your payroll processor, your bank, and any vendor who happens to send mail from a domain that looks unfamiliar will start showing up tagged "External" too, even though those are legitimate, expected senders. If staff see the tag on their bank's domain every single day, they start treating it as noise, and that defeats the purpose.

The fix is the AllowList parameter. It accepts specific 5322.From addresses, full domains, or wildcard domain patterns, and you can mix all three in one list:

Set-ExternalInOutlook -Identity Default -AllowList "payroll-vendor.com","billing@ourbank.com","*.regionalbank.com"

Anything on this list stops getting the external tag, even though it technically originates outside your tenant. Microsoft caps this list at 200 entries, so you want to be deliberate about what goes on it rather than adding every vendor your company has ever emailed. Stick to the handful that your staff interacts with constantly: your payroll processor, your primary bank, your benefits administrator, maybe your main legal and accounting firms. Everyone else stays tagged, which is exactly the behavior you want for anything new or unfamiliar.

Review the list every six months or so. Vendors change domains, banks get acquired, and an entry that made sense two years ago might now be shielding a stale address that nobody actually uses anymore.

Invoice fraud and business email compromise rarely involve someone hacking your network directly. They ride in on a convincing-looking email, and credential-related tactics show up somewhere in the attack chain in a large share of breaches investigated industry-wide; Verizon's 2026 Data Breach Investigations Report puts credential abuse at some point in 39% of breaches. A visible, trustworthy external tag doesn't stop every scam, but it gives your accounts payable staff one more second to pause before they click "pay" or update a bank routing number based on an email alone.

This control pairs well with broader email hardening, like DMARC enforcement and conditional access policies, which we typically cover as part of a full cybersecurity engagement rather than a one-off setting. If your business handles sensitive financial or health data, this kind of email control also feeds directly into obligations under the FTC Safeguards Rule or HIPAA, depending on your industry.

If you manage Microsoft 365 in-house and want to see where your tenant stands beyond just this one setting, our Microsoft 365 security score tool is a quick way to spot other gaps. And if you'd rather have someone else own this kind of configuration permanently, our Microsoft 365 managed services team handles exactly this sort of tuning for businesses across Houston, the Woodlands, and Round Rock.

Does the external tag work in classic Outlook desktop, not just new Outlook?

Support depends on your Outlook build. The feature is designed for new Outlook for Windows, Outlook on the web, and Outlook mobile. If a chunk of your staff is still on an older classic Outlook build, check your current version against Microsoft's documentation before assuming everyone will see the tag the same way.

Will the AllowList stop phishing from a spoofed vendor domain?

No. The AllowList only suppresses the tag for addresses or domains you specify; it doesn't verify whether a given message actually came from that domain. Pair it with DMARC enforcement and spam filtering so a spoofed look-alike domain still gets flagged, while your real vendor's mail stays clean of the external tag.

Can we apply different AllowList entries to different departments?

The Set-ExternalInOutlook cmdlet applies at the organization level through the Default identity. It's a single tenant-wide list, not a per-department policy, so you'll want to build one list that covers legitimate external senders across the whole company.

What happens if we hit the 200-entry cap?

You'll need to prune the list. Prioritize domains and addresses your staff interacts with daily, like payroll and banking, and remove stale entries for vendors you no longer work with regularly.

If you want this configured correctly the first time, including the old mail flow rule cleanup and a sensible AllowList, request a free IT assessment or contact our team and we'll walk your tenant through it.