CIS.M365.1.3.3: Ensure 'External sharing' of calendars is not available

CIS Benchmark notice

This check implements a recommendation of the CIS Microsoft 365 Foundations Benchmark. The benchmark text is © Center for Internet Security, Inc. and is not reproduced here beyond the short summary below. Get the full benchmark free of charge from cisecurity.org.

ID	CIS.M365.1.3.3
Severity	Medium
Suite	CIS Microsoft 365 Foundations Benchmark
Product	Microsoft 365
Related products	Exchange Online
Feature	Organization settings
Security area	External access and sharing
Resource type	Policy
User impact of fixing	Low
Effort to fix	Low
Benchmark	CIS Microsoft 365 Foundations Benchmark 7.0.0, 1.3.3 (L2, E3 Level 2)
Framework controls	cis-m365:1.3.3 nist-800-53-r5:AC-3 Access Enforcement nist-800-53-r5:SC-7(10) Boundary Protection | Prevent Exfiltration
MITRE ATT&CK	T1591
Reads from	Exchange Online

What this checks and how to fix it

1.3.3 (L2) Ensure ‘External sharing’ of calendars is not available

External calendar sharing allows an administrator to enable the ability for users to share calendars with anyone outside of the organization. Outside users will be sent a URL that can be used to view the calendar.

Rationale

Attackers often spend time learning about organizations before launching an attack. Publicly available calendars can help attackers understand organizational relationships and determine when specific users may be more vulnerable to an attack, such as when they are traveling.

Impact

This functionality is not widely used. As a result, it is unlikely that implementation of this setting will cause an impact to most users. Users that do utilize this functionality are likely to experience a minor inconvenience when scheduling meetings or synchronizing calendars with people outside the tenant.

Remediation action

To remediate using the UI:

1. Navigate to Microsoft 365 admin center https://admin.microsoft.com.
2. Click to expand Settings select Org settings.
3. In the Services section click Calendar.
4. Uncheck Let your users share their calendars with people outside of your organization who have Office 365 or Exchange.
5. Click Save.

PowerShell

1. Connect to Exchange Online using Connect-ExchangeOnline.
2. Run the following Exchange Online PowerShell command:

Set-SharingPolicy -Identity "Default Sharing Policy" -Enabled $False

Related links

• Microsoft 365 Admin Center
• Share Microsoft 365 calendars with people outside your organization
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 56

---

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: soulemike; contributors: merill, NZLostboy. Open-source licences.