Is it possible to get a list of addresses that are "outside your organization" in Outlook 365?

Question

I use "Outlook on the Web" (OWA) to access my company email address.

Some emails that I receive include the following warning:

This sender [email protected] is from outside your organization. Block sender.

Sometimes emails that originate from outside my organization do not also include the warning.

Where in OWA can I find a list of domains or addresses that get the warning applied?

Alternatively, is there a way in OWA to list the domains and addresses that are considered "Internal" to the organization, so I can figure out which domains are "External" to my account?

Answer 1

How can I find a list of addresses that are "outside your organization"?

1. Search your messages in the web app for any that you know to originate from other organizations and note any missing the "External Sender Identification."
2. Ask your organization's mail admins to provide you with the contents of their exception list.
3. Access the information via ExchangePowerShell using admin privileges.

External Sender Identification

Your organization uses "External Sender Identification" to add a warning message to incoming emails that originate from outside your organization.

Email is considered to originate from outside your organization if the sender domain doesn't match one of Exchange's "accepted" domains. "Accepted" domains are any that are configured in Exchange as either "authoritative" or "relay" domains.

Exchange admins can optionally exclude messages that would otherwise be identified by adding addresses and/or domains to an exception list.

Why can't I access the list?

Current security best practices are based on "keeping doors closed unless and until they need opening" rather than "closing doors as needed."

• Non-privileged users are exposed to the "accepted" domains that are relevant to them (eg. organization email/alias domains, directory listings, etc.).
• Non-privileged users are exposed to exceptions to 'external sender identification' that is relevant to them when a message they know to be from another organization is not identified.
• I don't yet see a compelling use case presented for allowing non-privileged users to query the exception list or the Exchange domain configuration.
• I do see security risks associated with non-privileged access to these tools.

Additional Resources:

• Set-ExternalInOutlook  _{^{Microsoft Learn  |  Jan 20, 2021}}

• ExchangePowerShell / Exchange PowerShell  _{^{Microsoft Learn  |  est. late 2021/early 2022}}

• Accepted domains in Exchange Server  _{^{Microsoft Learn  |  Feb 21, 2023}}

• How do I get rid of the "External" label in Outlook?  ^{_{Super User SE  |  Jan 20, 2023}} 

• How to Enable and Use Exchange Online’s External Email Tagging Feature  _{^{Office 365 for IT Pros   |   Mar 11, 2021}}

• Enable External Email Warning Tag in Exchange Online  _{^{Office 365  Reports  |  Apr 27, 2021}}

• How to Add External Email Warning and Tag to Office 365 and Outlook  _{^{LazyAdmin  |  May 23, 2022}}