CreativeTechsBaseline
tenant security posture
CTB-29 · Tier 1 · Silent · M365 / GWS

External sender warnings — external flag and MailTips

CISA SCuBA MS.EXO.7.1Huntress External flag + MailTips · Medium · FoundationalMaester MT.10392 authorities
0
Tenants failing
0
Tenants meeting
0
Measured
REQUIRED
Disposition
The settingWhat we hold this to
CreativeTechs minimum
External sender identification enabled tenant-wide. MailTips enabled org-wide with the external recipient tip on.
Benchmark position
CISA MS.EXO.7.1 — external sender warnings SHALL be implemented. Same target; no gap.
Where the switch is
Exchange admin centre → Settings → Mail flow → external sender identification. MailTips is PowerShell only (below).
https://admin.exchange.microsoft.com
How to verify
Get-ExternalInOutlook | fl Enabled                       # expect True
Get-OrganizationConfig | fl MailTipsAllTipsEnabled,MailTipsExternalRecipientsTipsEnabled   # expect True,True
Across the fleet
Client
State
Evidence
Blackwing
UNKNOWN
No Secure Score evidence — awaiting Maester.
BravicaOne
UNKNOWN
No Secure Score evidence — awaiting Maester.
CMG Law
UNKNOWN
No Secure Score evidence — awaiting Maester.
CreativeTechs
UNKNOWN
No Secure Score evidence — awaiting Maester.
DCG One
UNKNOWN
No Secure Score evidence — awaiting Maester.
Diversified Management Services
UNKNOWN
No Secure Score evidence — awaiting Maester.
Double Z
UNKNOWN
No Secure Score evidence — awaiting Maester.
Electric Pen
UNKNOWN
No Secure Score evidence — awaiting Maester.
Graphiti Associates
UNKNOWN
No Secure Score evidence — awaiting Maester.
Guidance Engineering
UNKNOWN
No Secure Score evidence — awaiting Maester.
India Tree
UNKNOWN
No Secure Score evidence — awaiting Maester.
MIR Corp
UNKNOWN
No Secure Score evidence — awaiting Maester.
Phinney Bischoff
UNKNOWN
No Secure Score evidence — awaiting Maester.
Quiver Dental
UNKNOWN
No Secure Score evidence — awaiting Maester.
RHO Architects
UNKNOWN
No Secure Score evidence — awaiting Maester.
Retail Voodoo
UNKNOWN
No Secure Score evidence — awaiting Maester.
Riverstone
UNKNOWN
No Secure Score evidence — awaiting Maester.
SSF
UNKNOWN
No Secure Score evidence — awaiting Maester.
Slingshot Architecture
UNKNOWN
No Secure Score evidence — awaiting Maester.
Stoke
UNKNOWN
No Secure Score evidence — awaiting Maester.
Turnstyle
UNKNOWN
No Secure Score evidence — awaiting Maester.
Urban Animal
UNKNOWN
No Secure Score evidence — awaiting Maester.
WLIHA
UNKNOWN
No Secure Score evidence — awaiting Maester.
Zak Designs
UNKNOWN
No Secure Score evidence — awaiting Maester.
Why it matters
The cheapest anti-BEC control that exists. A visible EXTERNAL marker on a message claiming to be the CEO is what stops the wire transfer.
How we check
Huntress 'External Flag visible within Outlook' and 'MailTips enabled' (both Medium · Foundational). CISA.MS.EXO.7.1, Maester MT.1039.
Fix — M365
Exchange → enable external sender identification; enable MailTips org-wide.
Fix — Google
Gmail flags external senders in most contexts already — confirm, and enable the warning banners.
User notices
Users see a tag on external mail.
Expected pushback
None. Known weakness: people stop noticing the banner after a couple of weeks. It still beats the alternative and costs nothing.