Check ID:
Provider: Microsoft 365
Service:
Severity: MEDIUM
Categories:
Resource type:
admincenter_external_calendar_sharing_disabledProvider: Microsoft 365
Service:
admincenterSeverity: MEDIUM
Categories:
internet-exposed, trust-boundaries, e5Resource type:
NotDefinedWhat this check verifies
Microsoft 365 calendar sharing is evaluated at the organization level to determine if sharing with external recipients is disabled, including blocking anonymous access and links sent outside the tenant.Risk
Allowing external calendar sharing exposes meeting metadata (subjects, locations, attendees, patterns), weakening confidentiality. Adversaries can profile staff, craft convincing spear-phish or fake invites, time fraud attempts, and stage meeting hijacks, increasing BEC and social engineering success.Recommendation
Apply least privilege: disable external calendar sharing tenant-wide. If business-needed, allow only approved domains, require authenticated recipients (no anonymous), and limit details toFree/Busy (time only). Review sharing policies regularly under zero trust and defense in depth.
Remediation
- CLI
- Dashboard steps
Set-SharingPolicy -Identity “Default Sharing Policy” -Enabled $false
References
- https://learn.microsoft.com/en-us/microsoft-365/admin/manage/share-calendars-with-external-users?view=o365-worldwide
- https://m365scripts.com/microsoft365/how-to-stop-users-from-sharing-their-own-calendars/
- https://learn.microsoft.com/en-my/answers/questions/1165808/external-calendar-sharing-for-single-user-in-exo
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = admincenter_external_calendar_sharing_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks