{
  "id": "CB-M365-TENANT-002",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-002",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-002.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-002.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-TENANT-002",
    "title": "Disable LinkedIn account connections",
    "finding": {
      "title": "Users can connect their work account to LinkedIn",
      "description": "Users can share work contacts and profile data between Microsoft 365 and LinkedIn, outside the organization's control."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "entra-id",
      "user-settings",
      "linkedin",
      "data-sharing",
      "privacy"
    ],
    "setting": {
      "location": "Microsoft Entra admin center > Entra ID > Users > User settings > LinkedIn account connections",
      "default_value": "Yes",
      "recommended_value": "No"
    },
    "description": "The user setting **LinkedIn account connections** is set to **No**: users cannot link their\nwork account to a LinkedIn account, and LinkedIn profile information is not shown in Microsoft\n365 apps.\n",
    "rationale": "Once connected, LinkedIn and Microsoft 365 exchange profile and contact data. This builds a\npicture of the organization's people and relations that attackers use for targeted phishing,\nand it moves personal data to a third-party service, which matters under GDPR.\n",
    "impact": "Users no longer see LinkedIn profile cards in Outlook, Teams or other apps. Existing connections\nare removed.\n",
    "notes": "The setting has no public API.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Entra ID** > **Users** > **User settings** and read **LinkedIn account\n   connections**.\n3. Fail if it is **Yes** or **Selected group**.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as at least a Global Administrator.\n2. Browse to **Entra ID** > **Users** > **User settings**.\n3. Set **LinkedIn account connections** to **No** and select **Save**.\n",
      "rollback": "Set the option back to **Yes** or **Selected group**.\n"
    },
    "references": [
      {
        "title": "Integrate LinkedIn account connections in Microsoft Entra ID",
        "url": "https://learn.microsoft.com/entra/identity/users/linkedin-integration",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-21",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1593.001"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}