# How do you add an external email warning tag in Outlook and Microsoft 365?
URL: https://iblockspam.com/blog/outlook-external-email-warning-tag
Last updated: 2026-10-09
Published: 2026-10-09
Topic: Setup guides
Author: iBlockSpam Team
> Turn on the native External tag in Outlook with Set-ExternalInOutlook, or add a mail flow rule banner. Steps, exceptions and the trade-offs of each approach.
## Short answer
Run Set-ExternalInOutlook -Enabled $true in Exchange Online PowerShell. Outlook then shows an External tag on mail from outside senders, usually within 24 to 48 hours. Exempt trusted partners with the AllowList parameter. If you need a visible text banner instead, create a mail flow rule that prepends a disclaimer to mail from outside the organization.
A message signed "Your CEO" means something very different when it came from outside the company. An external warning tag puts that fact in front of the reader before they act. Microsoft 365 gives you two ways to do it: a native **External** tag in Outlook, and mail flow rules that add a banner or subject prefix.
This guide covers both, with the exact commands, the exceptions you'll need and the trade-offs. For the wider anti-phishing setup, see [how to stop phishing emails in Microsoft 365](https://iblockspam.com/blog/stop-phishing-emails-microsoft-365).
## What are your options for tagging external email?
| Method | What users see | Where you set it | Main drawback |
|---|---|---|---|
| Native External tag (`Set-ExternalInOutlook`) | An **External** tag near the subject, plus the sender's real address in some clients | Exchange Online PowerShell only | Small and easy to ignore; depends on the Outlook version |
| Mail flow rule banner (prepended disclaimer) | A colored text block at the top of the message body | Exchange admin center or PowerShell | Stays in replies and forwards; can't be added to encrypted or signed mail |
| Mail flow rule subject prefix (`[EXTERNAL]`) | Text added to the start of the subject | Exchange admin center or PowerShell | Breaks threading and stacks up in long threads |
| First contact safety tip | "You don't often get email from…" | Anti-phishing policy | Only on new or rare senders, not all external mail |
Most organizations should turn on the native tag and the first contact safety tip. Add a body banner only if you have a specific reason, covered below.
## How do you turn on the native External tag?
The setting is organization-wide and has no switch in the admin centers. Microsoft's [Set-ExternalInOutlook](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-externalinoutlook?view=exchange-ps) reference says the feature works in Outlook, Outlook for Mac, Outlook on the web, and Outlook for iOS and Android.
1. Check for existing subject-tagging rules. In the Exchange admin center, open **Mail flow** > **Rules** (`https://admin.exchange.microsoft.com/#/transportrules`) and look for rules that prepend `[External]` or similar to the subject. Microsoft says to disable those rules before you enable the native tag "to avoid duplication."
2. Connect to Exchange Online PowerShell and check the current setting:
```powershell
Connect-ExchangeOnline -UserPrincipalName admin@example.com
Get-ExternalInOutlook
```
3. `Get-ExternalInOutlook` returns `Enabled` and `AllowList` ([Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/get-externalinoutlook?view=exchange-ps)). If `Enabled` is `False`, turn it on:
```powershell
Set-ExternalInOutlook -Enabled $true
```
4. Wait. Microsoft says it "can take between 24 and 48 hours" for users to see the External icon.
5. Tell users what the tag means before it appears. The Outlook team suggests updating training and documentation when you enable it ([Microsoft Tech Community](https://techcommunity.microsoft.com/blog/exchange/native-external-sender-callouts-on-email-in-outlook/2250098)).
Don't pass a value to `-Identity`. Microsoft says it's typically not needed, and that an invalid value still changes the settings for the whole organization.
### What does the tag look like in each client?
According to Microsoft's announcement, Outlook on the web, Mac and mobile show an External tag in the message list. Outlook for Windows and Outlook on the web show the sender's email address in the reading pane info bar. Outlook mobile and Outlook for Mac show the tag in the reading pane, and users tap or click it to see the real address. The label is localized to the user's language, which a mail flow rule can't do.
Two limits are worth knowing. Older Outlook builds don't show the tag at all, and Microsoft's announcement lists minimum versions per client. And don't expect messages that were already in a mailbox before you enabled the feature to be tagged; admins report that only newly delivered mail gets the tag.
## How do you exempt trusted partners from the External tag?
Use the `AllowList` parameter. It takes a domain (`contoso.com`), a domain and all its subdomains (`*.contoso.com`) or single addresses, matched against the From address that users see. Microsoft caps it at 200 entries and 8 KB in total ([Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-externalinoutlook?view=exchange-ps)).
Plain values overwrite the whole list. To add or remove entries without touching the rest, use the hashtable syntax:
```powershell
Set-ExternalInOutlook `
-AllowList @{Add="partner.example"; Remove="old-vendor.example"}
```
Be sparing. A sister company that shares your premises might deserve an entry. A supplier you pay every month doesn't: invoice fraud usually arrives from a supplier's compromised account or a lookalike domain, and the tag is one of the few cues the reader gets. Our guide to [vendor invoice fraud](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection) explains why.
## How do you add a warning banner with a mail flow rule?
A banner is a block of text at the top of the message body. It's louder than the native tag and shows in every mail client, including third-party apps on phones. Microsoft documents the method as a disclaimer rule ([Microsoft Learn](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/disclaimers-signatures-footers-or-headers)).
### In the Exchange admin center
1. Go to **Mail flow** > **Rules** and select **Add a rule** > **Apply disclaimers**.
2. Name the rule, for example "External sender banner".
3. Under **Apply this rule if**, select **The sender** > **is external/internal**, then **Outside the organization**.
4. Add a second condition: **The recipient** > **is external/internal** > **Inside the organization**, so the banner only lands on inbound mail.
5. Under **Do the following**, choose **Apply a disclaimer to the message** > **prepend a disclaimer**, then **Enter text**. Disclaimer text can include HTML and inline CSS.
6. Choose the fallback action for messages the rule can't modify, such as encrypted mail (see below).
7. Under **Except if**, select **The subject or body** > **subject or body matches these text patterns** and enter a phrase from your banner. Microsoft recommends this exception so a conversation doesn't collect a banner on every reply.
8. On **Set rule settings**, consider **Test without Policy Tips** first. Microsoft recommends testing every mail flow rule before setting it to **Enforce**.
### In PowerShell
The same rule with [New-TransportRule](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/new-transportrule?view=exchange-ps):
```powershell
New-TransportRule -Name "External sender banner" `
-FromScope NotInOrganization `
-SentToScope InOrganization `
-ApplyHtmlDisclaimerLocation Prepend `
-ApplyHtmlDisclaimerText "CAUTION: This email came from outside the organization. Don't click links or open attachments unless you recognize the sender.
" `
-ApplyHtmlDisclaimerFallbackAction Ignore `
-ExceptIfSubjectOrBodyContainsWords "came from outside the organization" `
-Mode Audit
```
`-Mode Audit` logs what the rule would do without changing messages, like **Test without Policy Tips** in the admin center. When you're happy with what it would do, switch it on with `Set-TransportRule -Identity "External sender banner" -Mode Enforce`. For other security rules worth adding at the same time, see [mail flow rules for Microsoft 365 security](https://iblockspam.com/blog/microsoft-365-mail-flow-rules-for-security).
### Choose the fallback action carefully
The fallback decides what happens when the banner can't be inserted, for example in encrypted or signed messages ([Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/new-transportrule?view=exchange-ps)):
- **Wrap** (the default) puts the original message inside a new one as an attachment. Microsoft says not to use it in rules that affect incoming mail from external senders, because it interferes with Safe Attachments scanning.
- **Reject** bounces the message to the sender with an NDR. That's Microsoft's suggested alternative to Wrap, but it means external partners who send you encrypted mail get bounces.
- **Ignore** delivers the message without the banner.
For a warning banner, we think Ignore is the sensible choice. A missing banner on a signed message is a smaller problem than a bounced one.
## What are the downsides of banners and subject tags?
Microsoft built the native tag because customers kept hitting the same problems with rules ([Microsoft Tech Community](https://techcommunity.microsoft.com/blog/exchange/native-external-sender-callouts-on-email-in-outlook/2250098)):
- **Duplicates.** Subject prefixes stack into `[External] [External]` as replies go back and forth.
- **Broken threads.** Changing the subject breaks Outlook conversation threading.
- **Stale warnings.** The changed subject or body stays in replies and forwards, which confuses people once a thread becomes internal.
- **No localization.** Rules don't know which language each user reads.
- **Lost space.** Long prefixes push the real subject off small screens.
Three more caveats apply to body banners:
1. **The exception is a bypass.** Anyone who includes your exception phrase in a message also skips the banner. Keep the phrase specific, and don't publish it.
2. **Spoofs of your own domain may not count as "outside".** Microsoft treats a sender as outside the organization when the address *isn't* in one of your accepted domains, or is in an external relay domain ([Microsoft Learn](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/conditions-and-exceptions)). A forged `ceo@yourdomain` uses an accepted domain, so it may not match the condition and the banner may not appear. [DMARC at enforcement](https://iblockspam.com/blog/dmarc-setup-microsoft-365) and spoof protection deal with those messages; our guide to [email spoofing](https://iblockspam.com/blog/what-is-email-spoofing) explains the difference.
3. **Banner blindness.** A warning on every external message soon becomes background. That's an argument for keeping the native tag small and saving louder warnings for rarer events.
## How does the first contact safety tip fit in?
The first contact safety tip is a separate, rarer warning. It appears when a recipient gets mail from a sender for the first time, or doesn't often get mail from them. The text reads "You don't often get email from ." It's available in anti-phishing policies for all cloud mailboxes, not just Defender for Office 365, and Microsoft recommends turning it on ([Microsoft Learn](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about)).
1. In the Microsoft Defender portal, go to **Email & collaboration** > **Policies & rules** > **Threat policies** > **Anti-phishing** (`https://security.microsoft.com/antiphishing`).
2. Open the policy, edit **Actions**, and under **Safety tips & indicators** select **Show first contact safety tip**.
3. Or set it in PowerShell. The parameter's default is `$false` ([Microsoft Learn](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-antiphishpolicy?view=exchange-ps)):
```powershell
Set-AntiPhishPolicy -Identity "Office365 AntiPhish Default" `
-EnableFirstContactSafetyTips $true
```
Microsoft notes that the tip isn't stamped on S/MIME-signed messages, on mail that a bypass spam filtering (SCL -1) rule let through, or on mail to mailboxes created less than seven days ago. For messages with several recipients, it uses a majority model, so one recipient's tip can hint at another's contact habits.
The tip is what catches a "supplier" writing from a slightly different domain. Our guide to [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing) shows why that matters.
## How do you check that tagging works?
1. Send a test message from a personal webmail account to a work mailbox.
2. After the 24 to 48 hour window, confirm the External tag in Outlook on the web and on a phone.
3. If you added a banner, send both a plain text and an HTML message, then reply to confirm the banner isn't added twice.
4. Send an internal message and confirm it carries no tag or banner.
5. Open the test message headers in our [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) to see how Microsoft 365 handled it. Our guide to [Microsoft 365 spam headers](https://iblockspam.com/blog/microsoft-365-spam-headers-explained) explains each field.
## Next steps
1. Disable any `[External]` subject-prefix rules, then run `Set-ExternalInOutlook -Enabled $true`.
2. Turn on the first contact safety tip in your anti-phishing policies.
3. Add a body banner only if users rely on mail apps that don't show the native tag, and use the Ignore fallback.
4. Review the AllowList every quarter and remove anything you can't justify.
5. Run a free [Email Health Check](https://iblockspam.com/tools/email-health-check) to confirm your own SPF, DKIM and DMARC, so spoofs of your domain are handled before they reach anyone's inbox.
Browse more [setup guides](https://iblockspam.com/blog/topic/setup).
## Frequently asked questions
### How long does the Outlook External tag take to appear after I enable it?
Microsoft says it can take between 24 and 48 hours after you run Set-ExternalInOutlook -Enabled $true, and only in Outlook versions that support the feature. Don't expect messages already in the mailbox to be tagged. If nothing appears after two days, run Get-ExternalInOutlook to confirm the setting and check the user's Outlook version.
### Can I stop the External tag showing for a trusted partner?
Yes. Add the partner's domain or address to the AllowList with Set-ExternalInOutlook. You can list a domain, a domain with all subdomains (*.example.com) or single addresses, up to 200 entries and 8 KB in total. Keep the list short: every exemption removes a warning attackers might otherwise trip over.
### Should I tag external email with [EXTERNAL] in the subject line?
Microsoft recommends the native tag instead. Subject prefixes break Outlook conversation threading, pile up as [External] [External] when replies bounce back and forth, stay on the message if the thread later becomes internal, and take space on small screens. If you still use a prefix rule, turn it off before enabling the native tag.
### Is the first contact safety tip the same as an External tag?
No. The External tag marks every message from outside your organization. The first contact safety tip, set in anti-phishing policies, appears only when a recipient has never or rarely received mail from that sender. They complement each other: the tag says where mail came from, and the tip flags a new sender, such as a changed supplier address.
### Does an external warning banner stop phishing emails?
No. It's a visual cue, not a filter. It helps a user notice that the 'CEO' writing from a free-mail account is outside the company, but people stop seeing banners they meet on every message. Use it alongside anti-phishing policies, DMARC and inbound filtering, not instead of them.
## Sources
- [Microsoft Learn: Set-ExternalInOutlook](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-externalinoutlook?view=exchange-ps)
- [Microsoft Learn: Get-ExternalInOutlook](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/get-externalinoutlook?view=exchange-ps)
- [Microsoft Tech Community: Native external sender callouts on email in Outlook](https://techcommunity.microsoft.com/blog/exchange/native-external-sender-callouts-on-email-in-outlook/2250098)
- [Microsoft Learn: Organization-wide message disclaimers, signatures, footers, or headers in Exchange Online](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/disclaimers-signatures-footers-or-headers)
- [Microsoft Learn: Mail flow rule conditions and exceptions (predicates) in Exchange Online](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/conditions-and-exceptions)
- [Microsoft Learn: New-TransportRule](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/new-transportrule?view=exchange-ps)
- [Microsoft Learn: Anti-phishing policies in Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about)
- [Microsoft Learn: Set-AntiPhishPolicy](https://learn.microsoft.com/en-us/powershell/module/exchangepowershell/set-antiphishpolicy?view=exchange-ps)
## Free tools for this guide
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
---
Source: iBlockSpam, https://iblockspam.com/blog/outlook-external-email-warning-tag (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt