Account/Authentication - Application Permissions - Ensure Calendar Details Sharing With External Users is Disabled
Summary
Reason
Since, attackers always study about an organization before launching an attack, publicly available calendars can help them easily understand the organizational relationships and determine when specific users may be more vulnerable to attack, such as when they are travelling.
What If?
As this functionality is not used widely, it is unlikely that implementation of this setting will cause an impact to most users. However, the users utilizing this one may experience a minor inconvenience when scheduling meetings or synchronizing calendars with people outside the tenant.
How to?
- Select the Admin centers and click to expand Settings.
- Click Org settings.
- Select Calendar.
- Uncheck Let your users share their calendars with people outside of your organization who have Office 365 or Exchange.
- Now, click Save.
To disable the calendar details sharing with external users policy, use the Exchange Online PowerShell Module:- Connect to Exchange Online using Connect-ExchangeOnline.
- Now, run the following command:
- Connect to Exchange Online using Connect-ExchangeOnline.
- Now, run the following command:
Set -SharingPolicy -Identity "Name of the policy" -Enabled $False
Monitor:
- Select the Admin centers and click to expand Settings.
- Click Org settings.
- Select Calendar.
- Verify Let your users share their calendars with people outside of your organization who have Office 365 or Exchange is unchecked.
To verify the calendar details sharing with external users is disabled, use the Exchange Online PowerShell Module:- Connect to Exchange Online using Connect-ExchangeOnline.
- Now, run the following command:
- Connect to Exchange Online using Connect-ExchangeOnline.
- Now, run the following command:
Get -SharingPolicy | Where-Object { $_.Domains -like '*CalendarSharing*' }
3. Verify Enabled is set to False.
Comments
Post a Comment