Skip to content
MitoMito Docs

CISA.MS.EXO.6.2: Calendar details SHALL NOT be shared with all domains.
ID CISA.MS.EXO.6.2
Severity Medium
Suite CISA SCuBA baselines
Product Exchange Online
Feature Calendar and contact sharing
Security area External access and sharing
Resource type Policy
User impact of fixing Low
Effort to fix Low
Benchmark CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.EXO.6.2 (SHALL)
Framework controls cisa-scuba:MS.EXO.6.2
nist-800-53-r5:AC-3 Access Enforcement
nist-800-53-r5:SC-7(10)(a) Boundary Protection | Prevent Exfiltration
MITRE ATT&CK T1048, T1567, T1591
Reads from Exchange Online

What this checks and how to fix it

Section titled “What this checks and how to fix it”

Calendar details SHALL NOT be shared with all domains.

Rationale: Calendar details may contain information that should not be shared by default with all domains. Disabling sharing with all domains closes an avenue for data exfiltration while still allowing for legitimate use as needed.

Remediation action:

Section titled “Remediation action:”

To restrict sharing with all domains:

  1. Sign in to the Exchange admin center.
  2. On the left-hand pane under Organization, select Sharing.
  3. Select Individual Sharing.
  4. For all existing policies, select the policy, then select Manage domains.
  5. For all sharing rules under all existing policies, ensure Sharing with everyone and Anonymous do not include CalendarSharing.
Section titled “Related links”

Mito check, based on CISA ScubaGear. Author: soulemike; contributors: NZLostboy, merill. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.