Exchange Online Cross-Tenant Recall: What to Decide Before August

If your organisation uses Exchange Online, there is a significant change to message recall arriving in August 2026. Microsoft published Message Center post MC1423106 on July 10, 2026, announcing the general availability of cross-tenant message recall for Exchange Online. GA deployment begins mid-August 2026, with full rollout across all clouds (worldwide, GCC, GCC High, DoD and 21Vianet) by mid-September.

Summary

• Microsoft Exchange Online is adding cross-tenant message recall via MC1423016
• GA deployment starts mid-August 2026, full rollout by mid-September 2026
• The feature is disabled by default - receiving tenants must explicitly enable it
• Enabling requires configuration of an allow list of trusted sending tenants
• Only works for Microsoft 365-to-Microsoft 365 scenarios - not Gmail, Proton, or other providers
• This is an administrative decision, not a user feature - IT needs to own it before August
• MC reference: MC1423106

What Is Exchange Online Cross-Tenant Message Recall?

Why This Matters: The Problem Cross-Tenant Recall Solves

The limitation of single-tenant recall has been a long-standing frustration for IT and security teams. Consider the scenarios:

• A staff member accidentally sends a draft containing commercially sensitive information to a client contact instead of an internal reviewer

   

• A finance team member forwards a document with personal data to the wrong partner organisation

• A legal team sends privileged information to an external contact before a review cycle is complete

In all of these cases today, message recall does nothing once the message has left the tenant. With cross-tenant message recall configured between trusted partner organisations, the sender can attempt to recall it and if the receiving tenant permits it, Exchange Online processes the recall using the same mechanism as an internal recall.

As Tony Redmond notes, the greatest benefit is not avoiding embarrassment after an accidental send, but the ability to retrieve confidential information mistakenly sent to trusted partners in other Microsoft 365 tenants.

How Cross-Tenant Message Recall Works

The process is controlled entirely by the receiving tenant:

1. A sender in Tenant A selects a delivered message in Outlook and initiates a recall

2. Exchange Online processes the recall for any copies delivered within Tenant A using the existing recall mechanism

3. For external recipients in other Microsoft 365 tenants, Exchange Online checks whether those tenants have enabled cross-tenant recall and whether Tenant A is on their allow list

4. If both conditions are met, Exchange recalls the message using the same process as an internal recall

5. If the receiving tenant has not enabled cross-tenant recall, or Tenant A is not on their allow list, the recall fails for those recipients just like it does today

No client update is required. Everything is processed at the service level and the recall action in Outlook (new Outlook) triggers the process for all recipients simultaneously.

What Your Organisation Needs to Decide Before August

This feature arrives in mid-August. Since it is disabled by default, many organisations will do nothing, and it will not affect them. 

There are two questions every Exchange Online organisation should answer before GA:

1. Will you enable cross-tenant recall for inbound messages?

If you enable cross-tenant recall, you are allowing specified external organisations to recall messages delivered to your users' mailboxes. This is a governance decision, not just a technical one.

Arguments for enabling it:

- Builds trust and reduces risk with key partner organisations who share sensitive information with you
- Aligns with mutual information security objectives between organisations
- Reduces the blast radius of accidental disclosure in both directions

Arguments for careful scoping or holding off:

- Enabling recall gives the sending organisation an additional point of control over content that has already been delivered into your environment
- For regulated sectors (legal, financial services, healthcare), there may be compliance implications around message retention, legal hold, and eDiscovery when messages can be recalled by external parties
- An overly broad allow list introduces risk

The right answer depends on your organisation's relationships, data classification, and compliance requirements. The critical point is to make sure you don't let the default make this decision for you.

2. Which external tenants will you trust?

If you enable cross-tenant recall, you must configure an allow list of specific Microsoft 365 tenant IDs. If you enable the feature without an allow list, no external tenant can recall messages — the feature is technically on but has no effect.

An allow list should be:

- Scoped to known, trusted partner organisations with whom you regularly exchange sensitive information
- Reviewed and approved through your standard vendor or third-party governance process
- Documented as part of your external communications policy
- Reviewed periodically, at minimum annually

How to Configure Cross-Tenant Message Recall

Configuration is handled via Exchange Online PowerShell using the new Set-CrossTenantRecallConfiguration cmdlet. Note: as of publishing, this cmdlet is not yet available in V3.10 of the Exchange Online management module. It will arrive ahead of mid-August GA.

To enable cross-tenant recall for inbound messages:

Set-CrossTenantRecallConfiguration -CrossTenantRecallEnabled $true 

To add specific tenants to your allow list (using their Microsoft 365 tenant IDs):

Set-CrossTenantRecallConfiguration -AllowedSenderTenantIds @{Add="tenant-id-1","tenant-id-2"} 

You can find any tenant's ID using whatismytenantid.com.

To disable cross-tenant recall:

Set-CrossTenantRecallConfiguration -CrossTenantRecallEnabled $false 

The default state is $false - no action means cross-tenant recall is off.

Step-by-Step Preparation Checklist

Step 1: Review your external communications landscape

Identify the partner organisations with which your teams regularly exchange sensitive or commercially important information. These are your candidates for an allow list.

Step 2: Assess your compliance and retention obligations

For regulated organisations, review whether enabling cross-tenant recall is compatible with your message retention, legal hold, and eDiscovery obligations. In some sectors, the ability for an external party to recall a delivered message may have compliance implications that require legal sign-off.

Step 3: Make a documented decision

Decide whether to enable the feature. If yes, produce an approved list of partner tenant IDs. This decision should involve IT security and legal or compliance stakeholders, not just Exchange administrators.

Step 4: Prepare the PowerShell configuration

Test the cmdlet in a non-production environment once it becomes available in the Exchange Online management module ahead of mid-August GA.

Step 5: Communicate to users if you enable the feature

If you enable cross-tenant recall with key partners, let your users know. They may not be aware that message recall now works externally in some cases, and knowing when it's available helps them use it appropriately.

Step 6: Document and review your allow list

Treat your allow list like any other vendor access control. Document why each tenant ID is included, who approved it, and when it is due for review.

What Cross-Tenant Recall Does Not Cover

Cross-tenant message recall has important limitations that users and IT teams need to understand:

• Non-Microsoft 365 destinations are not supported
  • If a message is sent to Gmail, Google Workspace, Proton Mail, or any non-M365 email provider, cross-tenant recall cannot retrieve it. Sensitive email sent externally outside the M365 ecosystem still requires sensitivity labels with encryption to restrict access; recall is not available as a fallback.
    
    
• The receiving tenant must opt in
  • If your partner organisation has not enabled cross-tenant recall and added your tenant to their allow list, recall will fail for messages delivered to their users, even if you have fully configured your side.
    
    
• Recall is not guaranteed even within M365
  • As with single-tenant recall, success depends on service-level factors. Cross-tenant recall is not a guaranteed delete mechanism.
    
    
• No support for non-Outlook clients announced
  • Recall initiation is through Outlook (new Outlook). The service-level processing handles the cross-tenant coordination, but the trigger point is the Outlook recall action.

The Broader Pattern of M365 Change

Cross-tenant message recall is part of a steady expansion of Exchange Online's security and governance surface, part of the same trajectory that brought enhanced message recall in 2023, the ability to recall protected messages, and recall via Outlook mobile.

What makes this change different from many others is that it requires an administrative decision and configuration before GA. It is not a feature that turns on and disrupts existing workflows. But it is one that will quietly arrive in mid-August with no automatic effect, and organisations that don't review it will miss an opportunity to strengthen how they protect confidential information shared with trusted partners.

This is the pattern of M365 evergreen change. Features land, deadlines approach, and the organisations that have a reliable system for tracking what's in Message Center and routing it to the right decision-makers act early. The ones that don't find out later — usually from a user asking why something doesn't work, or from a data breach that a recalled message might have prevented.

You can view MC1423106 in the ChangePilot portal for a structured breakdown, impact assessment, and action tracking.

Frequently Asked Questions

What is Exchange Online cross-tenant message recall?

Cross-tenant message recall is a new Exchange Online capability announced in MC1423106 that allows a sender to recall a message delivered to a recipient in another Microsoft 365 tenant, provided that the receiving tenant has enabled the feature and added the sending organisation to their allow list. It extends the existing in-tenant recall capability across the M365-to-M365 boundary. General availability begins mid-August 2026.

When is Exchange Online cross-tenant message recall available?

General availability begins mid-August 2026, with full deployment across all Microsoft 365 clouds by mid-September 2026. The feature is disabled by default — receiving tenants must explicitly enable it and configure an allow list before it takes effect.

Does my organisation need to do anything before cross-tenant recall goes live in August?

Yes. Even though the feature is opt-in and disabled by default, your organisation should make a deliberate decision before GA in mid-August. You should decide whether to enable cross-tenant recall for inbound messages, identify which partner organisations should be on your allow list, assess any compliance implications, and prepare the PowerShell configuration ahead of the rollout.

How does a receiving tenant control cross-tenant message recall?

The receiving tenant uses the Set-CrossTenantRecallConfiguration cmdlet in Exchange Online PowerShell to enable or disable the feature and manage the allow list of external tenant IDs permitted to recall messages. If the feature is enabled but no allow list is configured, no external tenant can recall messages. The cmdlet is expected to arrive in the Exchange Online management module ahead of mid-August GA.

Can cross-tenant recall retrieve messages sent to Gmail or non-Microsoft 365 recipients?

No. Cross-tenant message recall only works between Microsoft 365 tenants. Messages delivered to Gmail, Google Workspace, Proton Mail, or any non-Microsoft 365 email provider cannot be recalled. For sensitive information sent outside the M365 ecosystem, sensitivity labels with encryption remain the appropriate protection mechanism.

Is cross-tenant message recall guaranteed to work?

No. Recall success depends on whether the receiving tenant has enabled the feature and included the sending tenant in their allow list. If either condition is not met, recall fails for that recipient. Even when both conditions are met, recall operates on the same service-level basis as single-tenant recall and is not a guaranteed delete mechanism.

What is the allow list for cross-tenant message recall?

The allow list is a set of Microsoft 365 tenant IDs that a receiving tenant has explicitly permitted to recall messages delivered to their users. It is configured using Set-CrossTenantRecallConfiguration with the -AllowedSenderTenantIds parameter. Without an allow list entry, no external organisation can recall messages from your mailboxes, even if cross-tenant recall is enabled.

Does cross-tenant message recall require changes to Outlook or other clients?

No client updates are required. The recall is processed entirely at the Exchange Online service level. Users initiate a recall using the same recall action in Outlook (new Outlook) that they use for internal recalls today. The service handles all cross-tenant coordination in the background.

What happens if my organisation does nothing before August 2026?

If your organisation takes no action, cross-tenant message recall remains disabled by default and nothing changes for your users. However, you will also miss the window to configure trusted partner relationships before GA — meaning that if a sensitive message is sent in error to a partner organisation in August or September, you will not have the recall option available. Making a deliberate decision now — even if that decision is not to enable it — is better than passive inaction.