How do you add an external email warning tag in Outlook and Microsoft 365?

A message signed "Your CEO" means something very different when it came from outside the company. An external warning tag puts that fact in front of the reader before they act. Microsoft 365 gives you two ways to do it: a native External tag in Outlook, and mail flow rules that add a banner or subject prefix.

This guide covers both, with the exact commands, the exceptions you'll need and the trade-offs. For the wider anti-phishing setup, see how to stop phishing emails in Microsoft 365.

What are your options for tagging external email?

Most organizations should turn on the native tag and the first contact safety tip. Add a body banner only if you have a specific reason, covered below.

How do you turn on the native External tag?

The setting is organization-wide and has no switch in the admin centers. Microsoft's Set-ExternalInOutlook reference says the feature works in Outlook, Outlook for Mac, Outlook on the web, and Outlook for iOS and Android.

1. Check for existing subject-tagging rules. In the Exchange admin center, open Mail flow > Rules (https://admin.exchange.microsoft.com/#/transportrules) and look for rules that prepend [External] or similar to the subject. Microsoft says to disable those rules before you enable the native tag "to avoid duplication."
2. Connect to Exchange Online PowerShell and check the current setting:

Connect-ExchangeOnline -UserPrincipalName admin@example.com
Get-ExternalInOutlook

3. Get-ExternalInOutlook returns Enabled and AllowList (Microsoft Learn). If Enabled is False, turn it on:

Set-ExternalInOutlook -Enabled $true

4. Wait. Microsoft says it "can take between 24 and 48 hours" for users to see the External icon.
5. Tell users what the tag means before it appears. The Outlook team suggests updating training and documentation when you enable it (Microsoft Tech Community).

Don't pass a value to -Identity. Microsoft says it's typically not needed, and that an invalid value still changes the settings for the whole organization.

What does the tag look like in each client?

According to Microsoft's announcement, Outlook on the web, Mac and mobile show an External tag in the message list. Outlook for Windows and Outlook on the web show the sender's email address in the reading pane info bar. Outlook mobile and Outlook for Mac show the tag in the reading pane, and users tap or click it to see the real address. The label is localized to the user's language, which a mail flow rule can't do.

Two limits are worth knowing. Older Outlook builds don't show the tag at all, and Microsoft's announcement lists minimum versions per client. And don't expect messages that were already in a mailbox before you enabled the feature to be tagged; admins report that only newly delivered mail gets the tag.

How do you exempt trusted partners from the External tag?

Use the AllowList parameter. It takes a domain (contoso.com), a domain and all its subdomains (*.contoso.com) or single addresses, matched against the From address that users see. Microsoft caps it at 200 entries and 8 KB in total (Microsoft Learn).

Plain values overwrite the whole list. To add or remove entries without touching the rest, use the hashtable syntax:

Set-ExternalInOutlook `
  -AllowList @{Add="partner.example"; Remove="old-vendor.example"}

Be sparing. A sister company that shares your premises might deserve an entry. A supplier you pay every month doesn't: invoice fraud usually arrives from a supplier's compromised account or a lookalike domain, and the tag is one of the few cues the reader gets. Our guide to vendor invoice fraud explains why.

How do you add a warning banner with a mail flow rule?

A banner is a block of text at the top of the message body. It's louder than the native tag and shows in every mail client, including third-party apps on phones. Microsoft documents the method as a disclaimer rule (Microsoft Learn).

In the Exchange admin center

1. Go to Mail flow > Rules and select Add a rule > Apply disclaimers.
2. Name the rule, for example "External sender banner".
3. Under Apply this rule if, select The sender > is external/internal, then Outside the organization.
4. Add a second condition: The recipient > is external/internal > Inside the organization, so the banner only lands on inbound mail.
5. Under Do the following, choose Apply a disclaimer to the message > prepend a disclaimer, then Enter text. Disclaimer text can include HTML and inline CSS.
6. Choose the fallback action for messages the rule can't modify, such as encrypted mail (see below).
7. Under Except if, select The subject or body > subject or body matches these text patterns and enter a phrase from your banner. Microsoft recommends this exception so a conversation doesn't collect a banner on every reply.
8. On Set rule settings, consider Test without Policy Tips first. Microsoft recommends testing every mail flow rule before setting it to Enforce.

In PowerShell

The same rule with New-TransportRule:

New-TransportRule -Name "External sender banner" `
  -FromScope NotInOrganization `
  -SentToScope InOrganization `
  -ApplyHtmlDisclaimerLocation Prepend `
  -ApplyHtmlDisclaimerText "<p style='border:1px solid #b45309;padding:6px;'>CAUTION: This email came from outside the organization. Don't click links or open attachments unless you recognize the sender.</p>" `
  -ApplyHtmlDisclaimerFallbackAction Ignore `
  -ExceptIfSubjectOrBodyContainsWords "came from outside the organization" `
  -Mode Audit

-Mode Audit logs what the rule would do without changing messages, like Test without Policy Tips in the admin center. When you're happy with what it would do, switch it on with Set-TransportRule -Identity "External sender banner" -Mode Enforce. For other security rules worth adding at the same time, see mail flow rules for Microsoft 365 security.

Choose the fallback action carefully

The fallback decides what happens when the banner can't be inserted, for example in encrypted or signed messages (Microsoft Learn):

• Wrap (the default) puts the original message inside a new one as an attachment. Microsoft says not to use it in rules that affect incoming mail from external senders, because it interferes with Safe Attachments scanning.
• Reject bounces the message to the sender with an NDR. That's Microsoft's suggested alternative to Wrap, but it means external partners who send you encrypted mail get bounces.
• Ignore delivers the message without the banner.

For a warning banner, we think Ignore is the sensible choice. A missing banner on a signed message is a smaller problem than a bounced one.

What are the downsides of banners and subject tags?

Microsoft built the native tag because customers kept hitting the same problems with rules (Microsoft Tech Community):

• Duplicates. Subject prefixes stack into [External] [External] as replies go back and forth.
• Broken threads. Changing the subject breaks Outlook conversation threading.
• Stale warnings. The changed subject or body stays in replies and forwards, which confuses people once a thread becomes internal.
• No localization. Rules don't know which language each user reads.
• Lost space. Long prefixes push the real subject off small screens.

Three more caveats apply to body banners:

1. The exception is a bypass. Anyone who includes your exception phrase in a message also skips the banner. Keep the phrase specific, and don't publish it.
2. Spoofs of your own domain may not count as "outside". Microsoft treats a sender as outside the organization when the address isn't in one of your accepted domains, or is in an external relay domain (Microsoft Learn). A forged ceo@yourdomain uses an accepted domain, so it may not match the condition and the banner may not appear. DMARC at enforcement and spoof protection deal with those messages; our guide to email spoofing explains the difference.
3. Banner blindness. A warning on every external message soon becomes background. That's an argument for keeping the native tag small and saving louder warnings for rarer events.

How does the first contact safety tip fit in?

The first contact safety tip is a separate, rarer warning. It appears when a recipient gets mail from a sender for the first time, or doesn't often get mail from them. The text reads "You don't often get email from <email address>." It's available in anti-phishing policies for all cloud mailboxes, not just Defender for Office 365, and Microsoft recommends turning it on (Microsoft Learn).

1. In the Microsoft Defender portal, go to Email & collaboration > Policies & rules > Threat policies > Anti-phishing (https://security.microsoft.com/antiphishing).
2. Open the policy, edit Actions, and under Safety tips & indicators select Show first contact safety tip.
3. Or set it in PowerShell. The parameter's default is $false (Microsoft Learn):

Set-AntiPhishPolicy -Identity "Office365 AntiPhish Default" `
  -EnableFirstContactSafetyTips $true

Microsoft notes that the tip isn't stamped on S/MIME-signed messages, on mail that a bypass spam filtering (SCL -1) rule let through, or on mail to mailboxes created less than seven days ago. For messages with several recipients, it uses a majority model, so one recipient's tip can hint at another's contact habits.

The tip is what catches a "supplier" writing from a slightly different domain. Our guide to lookalike domain phishing shows why that matters.

How do you check that tagging works?

1. Send a test message from a personal webmail account to a work mailbox.
2. After the 24 to 48 hour window, confirm the External tag in Outlook on the web and on a phone.
3. If you added a banner, send both a plain text and an HTML message, then reply to confirm the banner isn't added twice.
4. Send an internal message and confirm it carries no tag or banner.
5. Open the test message headers in our Email Header Analyzer to see how Microsoft 365 handled it. Our guide to Microsoft 365 spam headers explains each field.

Next steps

1. Disable any [External] subject-prefix rules, then run Set-ExternalInOutlook -Enabled $true.
2. Turn on the first contact safety tip in your anti-phishing policies.
3. Add a body banner only if users rely on mail apps that don't show the native tag, and use the Ignore fallback.
4. Review the AllowList every quarter and remove anything you can't justify.
5. Run a free Email Health Check to confirm your own SPF, DKIM and DMARC, so spoofs of your domain are handled before they reach anyone's inbox.

Browse more setup guides.