Restrict Bookings shared pages to selected users

Description

Shared Bookings pages (booking calendars) can only be created by selected users:

• either Bookings is turned off for the organization (BookingsEnabled = False);
• or the default Outlook on the web mailbox policy has BookingsMailboxCreationEnabled = False, and only a dedicated mailbox policy assigned to approved users allows it.

Rationale

A shared Bookings page is a public web page and a mailbox. Pages created freely can expose staff names and schedules, collect personal data without a GDPR assessment, or be used to send convincing messages from the organization's domain. Limiting creation to people with a business need keeps these pages known and reviewed.

Impact

Users outside the approved policy cannot create new shared booking pages. Existing pages keep working; review and delete those that are not approved. Personal booking pages ("Bookings with me") are governed separately.

Audit

1. Connect to Exchange Online PowerShell with at least a Global Reader or View-Only Organization Management account.
2. Run Get-OrganizationConfig | Format-List BookingsEnabled.
3. If it is True, run Get-OwaMailboxPolicy | Format-Table Name, IsDefault, BookingsMailboxCreationEnabled.
4. List the users of each policy that allows creation with Get-CASMailbox -ResultSize Unlimited | Where-Object OwaMailboxPolicy -eq '<policy>'.
5. Fail if Bookings is enabled and the default policy has BookingsMailboxCreationEnabled = True, or if a policy allowing creation is assigned to users without approval.

Remediation

1. Connect to Exchange Online PowerShell as at least an Exchange Administrator.
2. To turn Bookings off entirely: Set-OrganizationConfig -BookingsEnabled $false, or in the Microsoft 365 admin center Settings > Org settings > Services > Bookings, clear Allow your organization to use Bookings.
3. To restrict it: Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -BookingsMailboxCreationEnabled $false, then create a policy for approved users:

   New-OwaMailboxPolicy -Name 'Bookings creators'
   Set-OwaMailboxPolicy -Identity 'Bookings creators' -BookingsMailboxCreationEnabled $true
   Set-CASMailbox -Identity <user> -OwaMailboxPolicy 'Bookings creators'
   

Rollback

Set BookingsMailboxCreationEnabled back to $true on the default policy.

References

• Turn Microsoft Bookings on or off Microsoft, vendor-doc, accessed 2026-10-24
• Set-OwaMailboxPolicy Microsoft, vendor-doc, accessed 2026-10-24
• Set-OrganizationConfig Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

People and lifecycle