How to Configure Message Recall, Delivery Delay, and Sensitive Information Types in Microsoft Outlook

Accidental email transmission represents one of the most persistent operational and compliance liabilities facing enterprise organisations. Whether an email is addressed to the incorrect recipient via Auto-Complete, contains sensitive customer financial records without appropriate encryption, or was dispatched prematurely in anger, the fallout can trigger severe regulatory penalties under GDPR or catastrophic corporate data leaks.

Microsoft Outlook and Microsoft 365 offer a multi-tiered safety net designed to mitigate these human errors before and after transmission. By configuring Cloud-Based Message Recall in Exchange Online, implementing automated Delivery Delay Rules to enforce an Outbox cooling-off buffer, and integrating Microsoft Purview Sensitive Information Types (SITs) for real-time Data Loss Prevention (DLP) policy tips, organisations can systematically prevent confidential data exposure. This guide details the complete configuration process across desktop, web, and tenant administrative boundaries.

---

Message Safety Mechanics: Architecture and Evaluation

Enterprise email protection operates across three distinct temporal phases: pre-flight DLP evaluation, Outbox spooling delay, and post-delivery cloud-based extraction.

Protection Layer	Operational Phase	Scope & Capability	Technical Boundary
DLP Policy Tips (SITs)	Pre-Transmission (Authoring)	Scans body and attachments for sensitive patterns (IBAN, passport numbers, credit cards) before sending.	Requires Microsoft 365 E3/E5 compliance licensing; evaluates client-side or during transport pipeline.
Delivery Delay (Deferred Send)	Transmission Buffer (Outbox)	Holds emails in local Outbox for 1–120 minutes, allowing users to modify, cancel, or re-route messages.	Client-side rule (Classic Outlook) or mailbox-level Undo Send timer (Outlook on the web / New Outlook).
Cloud Message Recall	Post-Delivery (Recipient Mailbox)	Extracts or replaces messages directly from recipient Exchange Online mailboxes even after delivery.	Tenant-level Exchange Online feature; operates across internal cloud mailboxes regardless of client state.

---

Architectural Shift: Cloud-Based Recall vs Legacy Client-Side Recall

Historically, the “Recall This Message” feature in classic Outlook was notorious for inconsistent behaviour. Under legacy MAPI protocols, recall relied on a special IPM.Outlook.Recall message sent to the recipient’s inbox. If the recipient was reading mail on a mobile device via ActiveSync, used a third-party IMAP client, or if their desktop client was closed, the recall failed completely—often alerting the recipient to read the unread message immediately.

In modern Exchange Online environments, Microsoft completely re-architected message recall into a Cloud-Based Recall Agent. When a sender triggers a recall:

1. The request is processed directly by the Exchange Online service fabric rather than the recipient’s client software.
2. The cloud recall agent accesses the recipient’s mailbox store directly on the server.
3. By default, the agent successfully purges or replaces unread messages even across different mobile clients, Mac clients, and Outlook on the web.
4. Administrators can even enable the recall of read messages within tenant boundaries, maintaining an audit trail of retracted corporate communications.

---

Step 1: Enabling Cloud-Based Message Recall in Exchange Admin Center

Exchange Online administrators can manage tenant-wide recall capabilities via the Exchange Admin Center (EAC) or Exchange Online PowerShell.

Method A: Exchange Online PowerShell

Connect to Exchange Online PowerShell and review the current tenant configuration:

# Connect to Exchange Online
Connect-ExchangeOnline -UserPrincipalName [email protected]

# Verify current Message Recall configuration
Get-OrganizationConfig | Select-Object -Property MessageRecall*

Configure optimal enterprise recall parameters:

# Enable cloud message recall and permit recall of read items
Set-OrganizationConfig -MessageRecallEnabled $true `
                       -MessageRecallReadStoreItemsEnabled $true `
                       -MessageRecallThresholdInDays 7 `
                       -MessageRecallWarningNotificationEnabled $true

Parameter	Recommended Value	Description
-MessageRecallEnabled	$true	Activates cloud-based message recall across the entire Exchange Online tenant.
-MessageRecallReadStoreItemsEnabled	$true	Permits the recall agent to retract messages even if the recipient has already opened them.
-MessageRecallThresholdInDays	7	Defines the maximum time window (up to 180 days) during which a sent message remains eligible for recall.

---

Step 2: Executing Message Recall from Outlook

When an urgent recall is required, end users can execute the action directly from their Sent Items folder:

1. Open Outlook (Classic Desktop, New Outlook, or Web).
2. Navigate to the Sent Items folder.
3. Double-click the target message to open it in a dedicated window.
4. In the ribbon, select File > Info (or the ellipsis ... menu in the top bar).
5. Click Message Resend and Recall > Recall This Message…
6. In the dialogue box, choose:
   • Delete unread copies of this message: Completely purges the email from recipient mailboxes.
   • Delete unread copies and replace with a new message: Opens a duplicate draft allowing immediate correction of attachments or addresses.
7. Check Tell me if recall succeeds or fails for each recipient and click OK.
8. Outlook generates an interactive cloud recall report detailing the exact status (Success, Failed, Read) across all internal recipients.

---

Step 3: Configuring Outbox Delivery Delay Rules in Classic Outlook

Because message recall cannot retract emails sent to external third-party domains (e.g., Gmail, Yahoo, or client domains), proactive outbound buffering is essential. Configuring a global 2-minute Outbox delay provides a universal “Undo Send” mechanism across all sent correspondence.

1. In Classic Outlook, navigate to File > Manage Rules & Alerts.
2. Click New Rule… to launch the Rules Wizard.
3. Under Start from a blank rule, select Apply rule on messages I send and click Next.
4. Leave all conditions unchecked to apply the rule to every outgoing message. Click Next and confirm by clicking Yes when prompted that this rule will apply to every sent email.
5. In the Actions list, check the box for defer delivery by a number of minutes.
6. In the lower edit box, click the underlined link a number of and enter 2 (or up to 120 minutes). Click OK, then click Next.
7. (Optional Exception): Under Exceptions, check except if it is marked as importance and set it to High. This allows genuinely time-critical emergency alerts to bypass the spooling queue.
8. Name the rule Global Outbox Delay (2 Minutes), ensure Turn on this rule is checked, and click Finish.

With this rule active, clicking Send routes the message into the local Outbox folder for two minutes. If you realise a typo or missing attachment occurred, simply navigate to the Outbox, open the email, modify it, or delete it entirely before the transport agent picks it up.

---

Step 4: Configuring Undo Send in Outlook on the Web and New Outlook

For modern Outlook on the web (OWA) and the New Outlook for Windows app, delivery delay is managed natively via browser-optimised Undo Send settings:

1. Open Outlook on the web (outlook.office.com) or the New Outlook app.
2. Click the Settings gear icon in the top-right corner.
3. Navigate to Mail > Compose and reply.
4. Scroll down to the Undo send configuration section.
5. Adjust the slider from 0 up to 10 seconds.
6. Click Save.

After clicking Send, a notification bar appears at the bottom of the viewport displaying an Undo button for 10 seconds. Clicking Undo aborts server spooling and restores the message directly into draft editing mode.

---

Step 5: Implementing Sensitive Information Types (SITs) and DLP Policy Tips

To eliminate compliance oversights, Microsoft Purview DLP evaluates emails against predefined Sensitive Information Types (SITs) before the user even clicks Send.

To configure a policy in the Microsoft Purview Compliance Portal (compliance.microsoft.com):

1. Navigate to Data loss prevention > Policies > Create policy.
2. Select a template category (e.g., Financial > U.K. Financial Data) or choose Custom.
3. Under Locations, scope the policy to Exchange email.
4. Under Policy Settings, define rule conditions:
   • Content contains Sensitive Info Types: Add Credit Card Number, EU Debit Card Number, SWIFT Code, or U.K. National Insurance Number.
   • Recipient is: External to my organisation.
5. Configure incident actions:
   • Notify users in Office 365 services with a policy tip: Check this option. When an employee pastes an IBAN or credit card into Outlook, a prominent banner warns: “This message contains sensitive financial data. External transmission requires manager approval.”
   • Block the action: Block external delivery outright, or allow sender override with a logged business justification.
6. Turn the policy on and enforce policy tip display in the Outlook ribbon.

---

Troubleshooting Common Message Safety Failures

Observed Issue	Root Cause	Diagnostic & Remediation Step
Cloud Recall status reports Failed for specific recipients	Recipient is external (e.g., Gmail/Hotmail) or mail was forwarded outside tenant	Message recall is cryptographically and operationally restricted to internal Exchange Online mailboxes within the same tenant or trusted federated boundary.
Outbox delay rule fails to hold emails; messages dispatch instantly	Outlook was restarted or operating in cached mode without online spooling enabled	Classic Outlook delay rules are client-side rules; if Outlook is closed immediately after pressing Send, the message remains queued in Outbox until next launch. Verify Cached Exchange Mode is active.
Policy tips do not appear when sensitive information is typed	Outlook client cache is stale or Purview DLP policy replication is pending	DLP policies take up to 24 hours to replicate across Exchange Online transport agents. In Classic Outlook, verify policy tips are enabled under File > Options > Mail > Policy Tips.
Sender receives no recall status notification email	Recall status tracking was unchecked during execution or mail was sent via shared mailbox	When recalling on behalf of a shared mailbox, the recall status report is delivered to the shared mailbox Inbox, not the delegate’s personal account.

---

Operational Governance and Best Practices

• Mandate Client-Side Delay for High-Risk Departments: Deploy Group Policy Objects (GPO) or Intune Administrative Templates to enforce a 2-minute Outbox delay rule across all legal, HR, and finance workstations.
• Enforce Sensitivity Labels with Default Encryption: Configure Microsoft Purview Sensitivity Labels (e.g., Highly Confidential) that automatically apply Rights Management Services (RMS) encryption. Even if a message is sent to an incorrect external recipient, unauthenticated users cannot decrypt or open the content.
• Regularly Audit Cloud Recall Analytics: Security operations teams should review Exchange message tracking logs to identify recurring recall triggers, highlighting departments that may require additional security awareness training.