Disabling email autocomplete for safety?

[BJG]

We recently started upgrading clients from 2019 to 365, and one of the changes was that the previous policy to disable autocomplete for email addresses stopped working. I wasn't concerned about this as I didn't know why it had been disabled anyway, but apparently this was for security concerns, and as some previous audit recommendation, to prevent people accidentally sending potentially confidential information to the wrong person.

 

I was curious to know general thoughts on this. There's a time and a place for protecting people against their own stupidity but it seems a bit OTT to me. Is it common practice to turn it off for this reason?

[DGardiner]

We recently started upgrading clients from 2019 to 365, and one of the changes was that the previous policy to disable autocomplete for email addresses stopped working. I wasn't concerned about this as I didn't know why it had been disabled anyway, but apparently this was for security concerns, and as some previous audit recommendation, to prevent people accidentally sending potentially confidential information to the wrong person.

 

I was curious to know general thoughts on this. There's a time and a place for protecting people against their own stupidity but it seems a bit OTT to me. Is it common practice to turn it off for this reason?

 

we didnt disable it but we publish a custom directory to staff so no kids can be included accidentaly

[mavhc]

Just fire people who can't read.

 

And set up systems to monitor email to make sure confidential information cannot be sent to the wrong person. Encrypt the documents with the public key of the person who should receive it, then you can email it to whoever you want.

[George_ARO]

Whilst it would be resolving the audit recommendations, you'll have no visibility over when misdirected/bulk 'To' field mistakes occur unless you have another system in place. We typically recommend Egress Prevent (other solutions available) to our customers in Education, but it's obviously budget dependent.