{
  "id": "CB-M365-MAIL-013",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-013",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-013.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-MAIL-013.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-MAIL-013",
    "title": "Restrict calendar and contact sharing with external domains",
    "finding": {
      "title": "Users can share calendar details or contacts with any external domain",
      "description": "Meeting subjects, locations, attendees and contact lists can be published to anyone, which helps attackers map the organization and time their phishing."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "exchange-online",
      "sharing-policy",
      "calendar",
      "contacts",
      "external-sharing"
    ],
    "description": "Exchange Online sharing policies control what users can share from their calendar and contacts\nwith people outside the organization. Required value: **{{ external_calendar_sharing }}**.\n\n- `free_busy_only`: no sharing policy grants calendar details or contacts to all domains or to\n  anonymous users. Entries for `*` or `Anonymous` are limited to free/busy time\n  (`CalendarSharingFreeBusySimple`); `CalendarSharingFreeBusyDetail`,\n  `CalendarSharingFreeBusyReviewer` and `ContactsSharing` are only allowed for named partner\n  domains.\n- `disabled`: every sharing policy in use is turned off, so users cannot share their calendar\n  with external people at all.\n",
    "rationale": "A calendar shared with full details reveals who meets whom, when executives travel and which\nprojects are under way: material for targeted phishing and fraud. Shared contact folders leak\nnames and addresses. Free/busy time is enough for scheduling with partners; anything more should\nbe limited to known domains.\n",
    "impact": "Baseline: users can still share free/busy time with anyone and details with listed partner\ndomains. Hardened: external calendar sharing stops, including free/busy, and existing external\nshares stop working; organization relationships set up by administrators are not affected.\n",
    "parameters": [
      {
        "name": "external_calendar_sharing",
        "type": "enum",
        "description": "What users can share from their calendar and contacts with external people.",
        "default": "free_busy_only",
        "profile_defaults": {
          "hardened": "disabled"
        },
        "allowed": [
          "free_busy_only",
          "disabled"
        ]
      }
    ],
    "audit": {
      "manual": "1. Sign in to the Exchange admin center (https://admin.exchange.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Organization** > **Sharing** > **Individual sharing** and open each sharing\n   policy, starting with **Default Sharing Policy**.\n3. In Exchange Online PowerShell (read-only):\n   ```powershell\n   Get-SharingPolicy | Format-List Name, Default, Enabled, Domains\n   Get-EXOMailbox -ResultSize Unlimited -Properties SharingPolicy | Group-Object SharingPolicy | Select-Object Name, Count\n   ```\n4. With `free_busy_only`: fail if an enabled policy has a `*` or `Anonymous` entry with\n   `CalendarSharingFreeBusyDetail`, `CalendarSharingFreeBusyReviewer` or `ContactsSharing`.\n5. With `disabled`: fail if a policy used by at least one mailbox has `Enabled` set to `True`.\n"
    },
    "remediation": {
      "manual": "1. In the Exchange admin center, browse to **Organization** > **Sharing** > **Individual\n   sharing** and edit **Default Sharing Policy** (Exchange Administrator).\n2. With `free_busy_only`: change the **All domains** and **Anonymous** rules to **Calendar\n   free/busy information with time only**, remove contact sharing for them, and add named\n   partner domains if details must be shared. PowerShell equivalent:\n   ```powershell\n   Set-SharingPolicy -Identity \"Default Sharing Policy\" -Domains \"*:CalendarSharingFreeBusySimple\"\n   ```\n3. With `disabled`: clear the policy's **On** check box, or run\n   `Set-SharingPolicy -Identity \"Default Sharing Policy\" -Enabled $false`. Repeat for every policy\n   assigned to mailboxes.\n",
      "rollback": "Restore the previous `Domains` value or set `Enabled` back to `$true` on the policy.\n"
    },
    "references": [
      {
        "title": "Sharing policies in Exchange Online",
        "url": "https://learn.microsoft.com/exchange/sharing/sharing-policies/sharing-policies",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-SharingPolicy",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/set-sharingpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Exchange Online baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/exo.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.EXO.6.1v1",
        "relation": "equivalent"
      },
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.EXO.6.2v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-21",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-4",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1591"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}