Purpose
You can restrict the number of recipients per message in your Exchange organization, but there is no way to limit the number of external recipients a certain group of people can send to.
If you run the classic desktop Outlook for Windows, the RestrictExtRecips add-in will solve this problem.
Suppose an Exchange administrator has created a distribution list named "RestrictExtRecips_2". Number 2 after underscore means that each member of this list that runs Outlook with RestrictExtRecips add-in installed cannot set more than 2 external recipients in their message.
If a user adds 3 or more external addresses to the "To:" or "CC:" field, then the message will not be sent and Outlook will display a warning pop-up window.
Current version: 1.0.0.3
Installation
- As an Exchange Online admin, log into the Exchange Admin Center. Create a distribution list named RestrictExtRecips_2. In the Notes field, enter the prefix "Non-restricted:" and the comma-delimited string of internal domains. Example:
Non-restricted: @contoso.com, @contoso.onmicrosoft.com.
Make sure you are a member of this list.
- On a client workstation where Outlook is installed, download the RestrictExtRecips-Demo.zip file and extract all files to C:\Program Files\IvaSoft\RestrictExtRecips directory. Exit Outlook if it is running, then run RestrictExtRecips-Demo.msi and follow the instructions.
- Start Outlook and click File > Options > Add-ins. Select "COM add-ins" in the Manage: list box (at the bottom of the page) and click the Go button. Make sure that RestrictExtRecips is in the list.

Testing
- Open Outlook and create a new message. Insert three external addresses in the "To:" field. Populate the Subject: field. Click the Send button. A warning message will appear.

- Note that you can place any number of external recipients into the "BCC:" field.
Uninstallation
You can uninstall the add-in via Settings > Apps (called "Installed Apps" in Windows 11 and "Apps & features" in Windows 10).
Demo Version Notes
Using the demo, you have a predefined limit of 2 external recipients. In the full version, you can set any number from 0 (no external recipients allowed) to 500.
FAQ
Q. Will it help us be more GDPR compliant?
A. Yes. Sharing email addresses with other recipients is a breach of GDPR regulations—see this article: 5 Ways Your Emails Could Breach GDPR. With RestrictExtRecips, you can force users to use "BCC:" instead of "To:" and "CC:".
Q. How can I define the number of external recipients?
A. This number is defined by the name of the distribution list.
- If you wish to set the number to 5, you have to name the distribution list as "RestrictExtRecips_5".
- If you wish to set the number to 12, you have to name the distribution list as "RestrictExtRecips_12".
- If you want to disable external recipients completely, you have to name the distribution list as "RestrictExtRecips_0".
Q. What happens if the mailbox is a member of several "RestrictExtRecips_XXX" distribution lists?
A. The lowest number has priority over others. So if jdoe@contoso.com is at the same time a member of both "RestrictExtRecips_2" and "RestrictExtRecips_5" distribution lists, the allowed number of external recipients is 2 for jdoe@contoso.com.
Q. May I hide the "RestrictExtRecips_XXX" distribution list from address lists?

A. No. Hidden distribution lists are invisible to the add-in, which will prevent it from working correctly.
Pricing and Licensing
Payments are processed by PayPro Global.
- A Site license covers a single organization at one physical location, with unlimited installs.
- An Enterprise license covers all computers across a single organization worldwide, including all branches and remote users.
