Description
Exchange Online sharing policies control what users can share from their calendar and contacts with people outside the organization. Required value: {{ external_calendar_sharing }}.
free_busy_only: no sharing policy grants calendar details or contacts to all domains or to anonymous users. Entries for*orAnonymousare limited to free/busy time (CalendarSharingFreeBusySimple);CalendarSharingFreeBusyDetail,CalendarSharingFreeBusyReviewerandContactsSharingare only allowed for named partner domains.disabled: every sharing policy in use is turned off, so users cannot share their calendar with external people at all.
Rationale
A calendar shared with full details reveals who meets whom, when executives travel and which projects are under way: material for targeted phishing and fraud. Shared contact folders leak names and addresses. Free/busy time is enough for scheduling with partners; anything more should be limited to known domains.
Impact
Baseline: users can still share free/busy time with anyone and details with listed partner domains. Hardened: external calendar sharing stops, including free/busy, and existing external shares stop working; organization relationships set up by administrators are not affected.
Parameters
| Parameter | Baseline | Hardened | Bounds |
|---|---|---|---|
external_calendar_sharingenum. What users can share from their calendar and contacts with external people. | free_busy_only | disabled | one of free_busy_only, disabled |
The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.
Audit
- Sign in to the Exchange admin center (https://admin.exchange.microsoft.com) as at least a Global Reader.
- Browse to Organization > Sharing > Individual sharing and open each sharing policy, starting with Default Sharing Policy.
- In Exchange Online PowerShell (read-only):
Get-SharingPolicy | Format-List Name, Default, Enabled, Domains Get-EXOMailbox -ResultSize Unlimited -Properties SharingPolicy | Group-Object SharingPolicy | Select-Object Name, Count - With
free_busy_only: fail if an enabled policy has a*orAnonymousentry withCalendarSharingFreeBusyDetail,CalendarSharingFreeBusyReviewerorContactsSharing. - With
disabled: fail if a policy used by at least one mailbox hasEnabledset toTrue.
Remediation
- In the Exchange admin center, browse to Organization > Sharing > Individual sharing and edit Default Sharing Policy (Exchange Administrator).
- With
free_busy_only: change the All domains and Anonymous rules to Calendar free/busy information with time only, remove contact sharing for them, and add named partner domains if details must be shared. PowerShell equivalent:Set-SharingPolicy -Identity "Default Sharing Policy" -Domains "*:CalendarSharingFreeBusySimple" - With
disabled: clear the policy's On check box, or runSet-SharingPolicy -Identity "Default Sharing Policy" -Enabled $false. Repeat for every policy assigned to mailboxes.
Rollback
Restore the previous Domains value or set Enabled back to $true on the policy.
References
- Sharing policies in Exchange Online Microsoft, vendor-doc, accessed 2026-10-24
- Set-SharingPolicy Microsoft, vendor-doc, accessed 2026-10-24
- CISA SCuBA Exchange Online baseline CISA, standard, accessed 2026-10-24
Mappings
| Framework | ID | Relation | Note |
|---|---|---|---|
| NIST SP 800-53 Rev. 55.1.1 | AC-21 | related | |
| NIST SP 800-53 Rev. 55.1.1 | AC-4 | related | |
| CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0 | MS.EXO.6.1v1 | equivalent | |
| CISA SCuBA Microsoft 365 Secure Configuration Baselines2.0.0 | MS.EXO.6.2v1 | equivalent |
How this control relates to the other framework's: equivalent, stricter, looser, partial or related.
Threats mitigated
| Taxonomy | ID |
|---|---|
| MITRE ATT&CK | T1591 |
People and lifecycle
| Authors |
|
| Introduced in | v0.1.0 |
| Created, updated | 2026-10-24, 2026-10-24 |
| Translations | fr |
