{
  "id": "CB-M365-TENANT-019",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-019",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-019.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-019.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-TENANT-019",
    "title": "Restrict Bookings shared pages to selected users",
    "finding": {
      "title": "Any user can create a public Bookings page",
      "description": "Every user can publish a Bookings page that is reachable from the Internet, collects personal data and can be abused for phishing or spam under the organization's name."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "microsoft-365",
      "bookings",
      "exchange-online",
      "public-content"
    ],
    "description": "Shared Bookings pages (booking calendars) can only be created by selected users:\n\n- either Bookings is turned off for the organization (`BookingsEnabled` = `False`);\n- or the default Outlook on the web mailbox policy has `BookingsMailboxCreationEnabled` =\n  `False`, and only a dedicated mailbox policy assigned to approved users allows it.\n",
    "rationale": "A shared Bookings page is a public web page and a mailbox. Pages created freely can expose staff\nnames and schedules, collect personal data without a GDPR assessment, or be used to send\nconvincing messages from the organization's domain. Limiting creation to people with a business\nneed keeps these pages known and reviewed.\n",
    "impact": "Users outside the approved policy cannot create new shared booking pages. Existing pages keep\nworking; review and delete those that are not approved. Personal booking pages (\"Bookings with\nme\") are governed separately.\n",
    "audit": {
      "manual": "1. Connect to Exchange Online PowerShell with at least a Global Reader or View-Only\n   Organization Management account.\n2. Run `Get-OrganizationConfig | Format-List BookingsEnabled`.\n3. If it is `True`, run\n   `Get-OwaMailboxPolicy | Format-Table Name, IsDefault, BookingsMailboxCreationEnabled`.\n4. List the users of each policy that allows creation with\n   `Get-CASMailbox -ResultSize Unlimited | Where-Object OwaMailboxPolicy -eq '<policy>'`.\n5. Fail if Bookings is enabled and the default policy has\n   `BookingsMailboxCreationEnabled` = `True`, or if a policy allowing creation is assigned to\n   users without approval.\n"
    },
    "remediation": {
      "manual": "1. Connect to Exchange Online PowerShell as at least an Exchange Administrator.\n2. To turn Bookings off entirely: `Set-OrganizationConfig -BookingsEnabled $false`, or in the\n   Microsoft 365 admin center **Settings** > **Org settings** > **Services** > **Bookings**,\n   clear **Allow your organization to use Bookings**.\n3. To restrict it: `Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -BookingsMailboxCreationEnabled $false`,\n   then create a policy for approved users:\n   ```\n   New-OwaMailboxPolicy -Name 'Bookings creators'\n   Set-OwaMailboxPolicy -Identity 'Bookings creators' -BookingsMailboxCreationEnabled $true\n   Set-CASMailbox -Identity <user> -OwaMailboxPolicy 'Bookings creators'\n   ```\n",
      "rollback": "Set `BookingsMailboxCreationEnabled` back to `$true` on the default policy.\n"
    },
    "references": [
      {
        "title": "Turn Microsoft Bookings on or off",
        "url": "https://learn.microsoft.com/microsoft-365/bookings/turn-bookings-on-or-off",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-OwaMailboxPolicy",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/set-owamailboxpolicy",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-OrganizationConfig",
        "url": "https://learn.microsoft.com/powershell/module/exchangepowershell/set-organizationconfig",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-22",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}