Account/Authentication - Application Permissions - Ensure Calendar Details Sharing With External Users is Disabled

 

Summary

Users should not be allowed to share full details of their calendars with external users. 

Reason

Since, attackers always study about an organization before launching an attack, publicly available calendars can help them easily understand the organizational relationships and determine when specific users may be more vulnerable to attack, such as when they are travelling.

What If?

As this functionality is not used widely, it is unlikely that implementation of this setting will cause an impact to most users. However, the users utilizing this one may experience a minor inconvenience when scheduling meetings or synchronizing calendars with people outside the tenant.

How to?

To disable the calendar details sharing with external users, use the Microsoft 365 Admin Center:

1. Select the Admin centers and click to expand Settings.
2. Click Org settings.
3. Select Calendar.
4. Uncheck Let your users share their calendars with people outside of your organization who have Office 365 or Exchange.
5. Now, click Save.

To disable the calendar details sharing with external users policy, use the Exchange Online PowerShell Module:

1. Connect to Exchange Online using Connect-ExchangeOnline.
2. Now, run the following command:

Set -SharingPolicy -Identity "Name of the policy" -Enabled  $False

Monitor:

To verify the calendar details sharing with external users is disabled, use the Microsoft 365 Admin Center:

1. Select the Admin centers and click to expand Settings.
2. Click Org settings.
3. Select Calendar.
4. Verify Let your users share their calendars with people outside of your organization who have Office 365 or Exchange is unchecked.

To verify the calendar details sharing with external users is disabled, use the Exchange Online PowerShell Module:

1. Connect to Exchange Online using Connect-ExchangeOnline.
2. Now, run the following command:

Get -SharingPolicy | Where-Object { $_.Domains -like '*CalendarSharing*' }

      3. Verify Enabled is set to False.

-