{
  "id": "CB-M365-MAIL-005",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-005",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-005.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-005.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-005",
    "title": "Prevent users from adding personal email accounts and calendars in Outlook",
    "finding": {
      "title": "Users can connect personal mail accounts and calendars to their work Outlook",
      "description": "Work and personal mail mix in the same client, which makes it easy to move company data to a personal account and brings personal phishing into the work session."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "exchange-online",
      "outlook",
      "owa-policy",
      "personal-accounts",
      "data-leakage"
    ],
    "description": "Every Outlook on the web mailbox policy in use has:\n\n- `PersonalAccountsEnabled` set to `$false`: users cannot add Outlook.com, Gmail, Yahoo or other\n  personal accounts in the new Outlook for Windows and Outlook on the web;\n- `PersonalAccountCalendarsEnabled` set to `$false`: users cannot connect a personal Outlook.com\n  or Google calendar.\n",
    "rationale": "With a personal account in the same client, dragging a message or attachment from the work\nmailbox to the personal one takes one move and bypasses data loss prevention, retention and\naudit. Mail received on the personal account is not filtered by the organization's protections\nbut is read in the trusted work client.\n",
    "impact": "Users who read personal mail in the new Outlook must use a separate client or browser profile.\nPersonal accounts already added are removed from the client once the policy applies.\n",
    "audit": {
      "manual": "1. These settings are not shown in the Exchange admin center. Connect to Exchange Online\n   PowerShell as at least a Global Reader.\n2. Run (read-only):\n   ```powershell\n   Get-OwaMailboxPolicy | Format-Table Name, IsDefault, PersonalAccountsEnabled, PersonalAccountCalendarsEnabled\n   Get-CASMailbox -ResultSize Unlimited | Group-Object OwaMailboxPolicy | Select-Object Name, Count\n   ```\n   An empty `OwaMailboxPolicy` means the default policy applies.\n3. Fail if a policy used by at least one mailbox has `PersonalAccountsEnabled` or\n   `PersonalAccountCalendarsEnabled` set to `True`.\n"
    },
    "remediation": {
      "manual": "1. Connect to Exchange Online PowerShell as an Exchange Administrator.\n2. For each policy in use (the default one is usually `OwaMailboxPolicy-Default`):\n   ```powershell\n   Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -PersonalAccountsEnabled $false -PersonalAccountCalendarsEnabled $false\n   ```\n3. Changes can take up to a few hours to reach the clients.\n",
      "rollback": "Set both parameters back to `$true` on the policy.\n"
    },
    "references": [
      {
        "title": "Set-OwaMailboxPolicy",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/set-owamailboxpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "ASD Blueprint for Secure Cloud - Outlook web app policies",
        "url": "https://blueprint.asd.gov.au/configuration/exchange-online/roles/outlook-web-app-policies/",
        "publisher": "Australian Signals Directorate",
        "kind": "guide",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-4",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-20",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1567"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-MAIL-008",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}