Prevent users from adding personal email accounts and calendars in Outlook

Description

Every Outlook on the web mailbox policy in use has:

• PersonalAccountsEnabled set to $false: users cannot add Outlook.com, Gmail, Yahoo or other personal accounts in the new Outlook for Windows and Outlook on the web;
• PersonalAccountCalendarsEnabled set to $false: users cannot connect a personal Outlook.com or Google calendar.

Rationale

With a personal account in the same client, dragging a message or attachment from the work mailbox to the personal one takes one move and bypasses data loss prevention, retention and audit. Mail received on the personal account is not filtered by the organization's protections but is read in the trusted work client.

Impact

Users who read personal mail in the new Outlook must use a separate client or browser profile. Personal accounts already added are removed from the client once the policy applies.

Audit

1. These settings are not shown in the Exchange admin center. Connect to Exchange Online PowerShell as at least a Global Reader.
2. Run (read-only):

   Get-OwaMailboxPolicy | Format-Table Name, IsDefault, PersonalAccountsEnabled, PersonalAccountCalendarsEnabled
   Get-CASMailbox -ResultSize Unlimited | Group-Object OwaMailboxPolicy | Select-Object Name, Count
   

   An empty OwaMailboxPolicy means the default policy applies.
3. Fail if a policy used by at least one mailbox has PersonalAccountsEnabled or PersonalAccountCalendarsEnabled set to True.

Remediation

1. Connect to Exchange Online PowerShell as an Exchange Administrator.
2. For each policy in use (the default one is usually OwaMailboxPolicy-Default):

   Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -PersonalAccountsEnabled $false -PersonalAccountCalendarsEnabled $false
   

3. Changes can take up to a few hours to reach the clients.

Rollback

Set both parameters back to $true on the policy.

References

• Set-OwaMailboxPolicy Microsoft, vendor-doc, accessed 2026-10-24
• ASD Blueprint for Secure Cloud - Outlook web app policies Australian Signals Directorate, guide, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-MAIL-008 Block additional storage providers in Outlook on the web

People and lifecycle