Listen to this Post
Introduction:
In an era where Business Email Compromise (BEC) attacks are surging and phishing lures grow increasingly sophisticated, organizations struggle to help users distinguish legitimate internal communications from malicious external threats. Microsoft’s latest enhancement to Outlook Inbox Rules—allowing the External email tag to function as a rule condition—bridges this gap by transforming a passive warning label into an actionable security control. Rolling out across all Outlook platforms starting June 2026, this feature enables IT administrators to automate the segregation, prioritization, or quarantining of external emails, reducing human error and reinforcing the principle of least trust.
Learning Objectives:
- Enable and configure the External email tag using PowerShell and Exchange admin tools.
- Build automated Outlook rules that move external emails to a dedicated quarantine folder for layered defense.
- Monitor and audit external forwarding rules to prevent data exfiltration and BEC attacks.
You Should Know:
- Enabling the External Email Tag with PowerShell (and Managing Trusted Exceptions)
The External email tag is powered by the `ExternalInOutlook` feature in Exchange Online. Once activated, Outlook displays a conspicuous “External” label on messages from outside your organization. The June 2026 update extends this tag to Outlook’s rule engine, making it a first-class condition.
Before building rules, administrators must verify and enable the tagging feature. This is best done via Exchange Online PowerShell because it provides fine-grained control and batch configuration.
Step‑by‑step guide – Enable External Tagging and Set Trusted Domains
Run these commands from an elevated PowerShell session (requires Exchange Admin or Global Admin rights). The following commands install the necessary module, connect to Exchange Online, check current status, enable the feature, and configure an allow list so that trusted partners are never flagged:
Install the Exchange Online Management module (if not already present) Install-Module -Name ExchangeOnlineManagement -Force -AllowClobber Import the module Import-Module ExchangeOnlineManagement Connect to Exchange Online (MFA will be triggered if enabled) Connect-ExchangeOnline -UserPrincipalName [email protected] Check current configuration of external email tagging Get-ExternalInOutlook Enable external email tagging for the entire tenant Set-ExternalInOutlook -Enabled $true Add trusted partner domains to the allow list (external tagging will NOT apply to these) Set-ExternalInOutlook -AllowList "trustedpartner.com", "secure-vendor.net" Verify the updated configuration Get-ExternalInOutlook | Format-List
Explanation and Impact:
The `Set-ExternalInOutlook` cmdlet modifies the tenant’s external sender identification behavior. Enabling `-Enabled $true` ensures every message from outside your primary domain receives the visual “External” tag in the Outlook reading pane and message list. The `-AllowList` parameter is critical for operational continuity—emails from trusted partners, such as your payroll processor or legal counsel, will bypass tagging, preventing “warning fatigue” among users. Allow list entries accept full email addresses ([email protected]) or domains (trustedpartner.com). Propagation across Exchange Online servers may take 24–48 hours, so plan the rollout during a maintenance window.
- Creating Outlook Rules That Automatically Isolate External Emails
Once the External tag is enabled, it becomes available as a condition in the Outlook Rules Wizard across Windows (new), Mac, web, and mobile clients. This allows security teams to enforce consistent handling of external messages without relying on end‑user discretion. The most effective use case is redirecting all external messages to a dedicated “Quarantine” or “Review” folder, creating a safety buffer.
Step‑by‑step guide – Build a Rule to Segregate External Emails
The following steps apply to the new Outlook for Windows (web-based interface). For Outlook classic or Mac, the rule condition label is identical, though the wizard layout may vary slightly.
- Open Outlook and go to Settings: Click the gear icon in the upper‑right corner, then select Mail → Rules.
- Add a new rule: Click Add new rule. Give it a descriptive name, e.g.,
Move All External Emails to Quarantine. - Set the condition: Under When the message arrives, and it matches all these conditions, select It includes the “External” tag. (In some clients, this may appear as External under the “The sender is” category or as a dedicated toggle.)
- Define the action: Under Do all of the following, choose Move to folder. Click Select folder, then either choose an existing folder or click New folder to create one named
External Quarantine. - Add exceptions (optional): Use Except if → Sender is in my Safe Senders list to allow trusted external senders to bypass the rule and land in the main inbox. This is useful for customer support aliases or automated notifications.
- Save and apply: Click Save. The rule will process all incoming messages retroactively (if you check “Run rule now”) and forward.
Security Analysis:
Segregating external email into a separate folder imposes a “click‑delay” on phishing attempts. Users are trained to treat the quarantine folder as a high‑risk zone and verify any unexpected external request—especially those impersonating executives or vendors—through a secondary communication channel. This is a simple but effective defense‑in‑depth control that reduces the success rate of BEC attacks.
- Locking Down External Forwarding to Block Data Exfiltration
Attackers who compromise a mailbox often create a stealthy inbox rule that forwards all incoming (and sometimes outgoing) messages to an external attacker‑controlled email address. This technique is a hallmark of sophisticated BEC campaigns because it allows adversaries to monitor conversations, alter invoice details, or collect sensitive data for weeks without detection. Microsoft’s new External tag does not directly prevent forwarding, but it complements existing anti‑forwarding controls that every security team should enforce.
Step‑by‑step guide – Disable External Forwarding at the Tenant Level
You can block external automatic forwarding through the Microsoft Defender portal or via PowerShell. The portal approach is easier for most admins and includes a built‑in audit report.
Using the Microsoft Defender Portal:
- Sign in to the Microsoft 365 Defender portal with Global Admin or Security Admin credentials.
- Navigate to Email & Collaboration → Policies & Rules → Threat policies → Anti‑spam.
- Select the Anti‑spam outbound policy (Default) and click Edit protection settings.
- Scroll down to Automatic forwarding rules. Select Off – Forwarding is disabled.
5. Click Save.
- (Recommended) Create a custom outbound policy with forwarding On for a specific security group of service accounts that legitimately need external forwarding (e.g., a ticketing system). Assign that policy to the group and keep the default policy locked down.
Using PowerShell for scripted control:
Connect to Exchange Online (if not already) Connect-ExchangeOnline Get the current outbound spam policy Get-HostedOutboundSpamFilterPolicy Set automatic forwarding to off for the default policy Set-HostedOutboundSpamFilterPolicy -Identity "Default" -AutoForwardingMode $false Verify the change Get-HostedOutboundSpamFilterPolicy -Identity "Default" | Format-List AutoForwardingMode
Audit and monitor existing forwarding rules:
Even with forwarding disabled for new rules, a compromised mailbox may already have a malicious rule in place. Run the Auto‑forwarded message report in the Exchange admin center (Reports → Mail flow → Auto‑forwarded message report) to identify all mailboxes that have forwarded messages to external addresses in the past 90 days. Export the results and share them with your incident response team.
4. Detecting and Removing Malicious External-Email Rules
The new rule condition can be abused if an attacker gains access to a user’s mailbox. An adversary could create a rule that moves all emails from a specific external domain (e.g., a known customer) to the Deleted Items folder, effectively performing a denial‑of‑service on communication. Therefore, security teams must implement regular auditing of all Outlook rules across the tenant.
Step‑by‑step guide – Audit All Outlook Rules Using PowerShell
The following script connects to Exchange Online and exports every user’s inbox rules, allowing you to search for suspicious patterns such as rules referencing “External” in the condition but performing a “Delete” or “Forward” action.
Connect to Exchange Online (if not already)
Connect-ExchangeOnline
Get all mailboxes
$mailboxes = Get-Mailbox -ResultSize Unlimited
Array to store rule details
$ruleReport = @()
foreach ($mbx in $mailboxes) {
Write-Host "Processing $($mbx.DisplayName)..."
$rules = Get-InboxRule -Mailbox $mbx.UserPrincipalName | Select-Object Name, Description, Enabled, Conditions, Actions, ExceptIf
foreach ($rule in $rules) {
$ruleReport += [bash]@{
User = $mbx.DisplayName
UserPrincipalName = $mbx.UserPrincipalName
RuleName = $rule.Name
Description = $rule.Description
Enabled = $rule.Enabled
Conditions = $rule.Conditions
Actions = $rule.Actions
ExceptIf = $rule.ExceptIf
}
}
}
Export to CSV for analysis
$ruleReport | Export-Csv -Path "C:\SecurityAudit\OutlookRulesAudit.csv" -NoTypeInformation
What to look for:
- Rules with `MoveToFolder` or `DeleteMessage` actions combined with an `From` condition that points to a C‑level executive’s external domain (spoofing attack).
- Rules that forward to any email address not ending with your corporate domain.
- Rules that are disabled but appear in the report—attackers sometimes disable a rule after exfiltrating data to avoid detection.
- Integrating External Tag Rules with Microsoft Defender and Sentinel
For mature security operations centers (SOCs), the new rule condition should trigger alerts and automated responses. You can use Microsoft Graph API and Logic Apps to monitor for newly created Outlook rules that leverage the External tag and then raise incidents in Microsoft Sentinel.
Step‑by‑step guide – Create a Sentinel Alert for Suspicious External‑Email Rules
- In Microsoft Sentinel, navigate to Analytics → Create → Scheduled query rule.
- Use the following KQL query (ingests Exchange Online audit logs for rule creation events):
OfficeActivity
| where Operation in ("New-InboxRule", "Set-InboxRule")
| extend RuleParams = parse_json(Parameters)
| where RuleParams has "External"
| project TimeGenerated, UserId, Operation, ClientIP, RuleParams
| sort by TimeGenerated desc
- Set the query frequency to 5 minutes and the alert threshold to 1 event.
4. Configure automated playbooks to either:
- Trigger a Teams message to the security team.
- Run an Azure Automation runbook that disables the suspicious rule.
- Require MFA re‑authentication for the affected user.
This proactive detection ensures that even if an attacker sets up a malicious rule using the new External condition, you are alerted within minutes.
What Undercode Say:
- External tagging is a foundation, not a solution – The visual tag is only effective if users are trained to understand its meaning. Regular phishing simulations and security awareness programs turn the tag from a passive sticker into an active cognitive prompt.
- Automation reduces human reliance at the user level, but increases admin overhead – IT teams must now develop and maintain rule‑based segregation policies, audit them quarterly, and handle exceptions without creating data silos. Combining the External tag with outbound forwarding blocking creates a two‑pronged defense: one layer warns the user, the other cuts off data exfiltration routes.
- The new rule condition will be exploited – Adversaries will quickly learn to craft rules that redirect or delete external messages to cause business disruption. Organizations that do not implement the auditing and Sentinel‑based detection described above will be vulnerable to a new class of rule‑based denial‑of‑service attacks.
Prediction:
By the end of 2026, the Outlook External tag rule condition will become a de facto standard for Zero Trust email architectures. However, as adoption increases, attackers will pivot to more sophisticated techniques, such as leveraging compromised internal accounts to generate “internal” looking messages that bypass the External tag entirely. This will drive demand for email authentication methods like BIMI (Brand Indicators for Message Identification) and advanced impersonation detection in Microsoft Defender. Organizations that rely solely on the External tag without comprehensive user training and outbound forwarding controls will experience false confidence, leading to a spike in BEC incidents between Q3 2026 and Q1 2027.
▶️ Related Video (72% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Kavya A – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
