You can restrict the number of recipients per message in your Exchange organization, but there is no way to limit the number of external recipients a certain group of people can send to.
If you run Outlook 2013/2016/2019 on Windows, RestrictExtRecips add-in will solve this problem.
Let’s suppose an Exchange administrator has created a distribution list named “RestrictExtRecips_2”. Number 2 after underscore means that each member of this list that runs Outlook with RestrictExtRecips add-in installed cannot set more than 2 external recipients in his message.
If a user adds 3 or more external addresses to the “To:” or “CC:” field then the message will not be sent and Outlook will display a warning pop-up window.
The application is a COM add-in for Outlook.
Current version: 22.214.171.124
- As a user with exchange online administrator role log into exchange admin center. Create a distribution list  named RestrictExtRecips_2. To the “Notes” place the prefix “Non-restricted:” and the comma-delimited string of internal domains . Example:
Non-restricted: @contoso.com, @contoso.onmicrosoft.comMake sure you are a member of this list .
- On a client workstation where Outlook is installed download RestrictExtRecips-Demo.zip archive file and extract all files to C:\Program Files\IvaSoft\RestrictExtRecips directory.
Exit Outlook in case it is running, run RestrictExtRecips-Demo.msi and follow the instructions.
- Start Outlook and click File > Options > Add-ins. Select “COM add-ins” in the Manage: listbox (at the bottom of the page) and click Go button. Make sure that RestrictExtRecips is in the list.Click Exit button to close the program.
- Open Outlook and create a new message. Insert 3 external addresses in the To: field”. Populate the Subject: field. Click the Send button. A warning message will appear.
- Note that you can place any amount of external recipients into the “BCC:” field.
Select Start > Control Panel. Select Programs and features. Select RestrictExtRecips in the list. Right-click and select Uninstall. Follow the instructions.
About this demo version.
- Using the demo you have a pre-defined limit of 2 external recipients – no more, no less. Running the full version you can set any number from 0 (no external recipients allowed) to 500.
Q. Will it help us be more GDPR compliant?
A. Yes. As you know, sharing the email addresses with other recipients is a breach of GDPR regulations – have a look at this article: 5 Ways Your Emails Could Breach GDPR. With RestrictExtRecips you can force users to use “BCC:” instead of “To:” and “CC:”.
Q. How can I define the number of external recipients?
A. This number is defined by the name of the distribution list.
- If you wish to set the number to 5 you have to name the distribution list as “RestrictExtRecips_5”.
- If you wish to set the number to 12 you have to name the distribution list as “RestrictExtRecips_12”.
- If you want to disable external recipients completely you have to name the distribution list as “RestrictExtRecips_0”.
Q. What happens if the mailbox is a member of several “RestrictExtRecips_XXX” distribution lists?
A. The lowest number has priority over others.
- So if [email protected] is in the same time a member of both “RestrictExtRecips_2” and “RestrictExtRecips_5” distribution lists, the allowed number of external recipients is 2 for [email protected]
Q. May I hide “RestrictExtRecips_XXX” distribution list from address lists?
A. No, don’t do that. As soon as you you hide a distribution list, it becomes invisible for RestrictExtRecips add-in.