Do not allow Exchange Online calendar details to be shared with external users

Question

Do not allow Exchange Online calendar details to be shared with external users

ADM-Griffin2, Jay 151

This recommendation in the Security Score calculations, on the Microsoft 365 Defender dashboard, does not appear to be accurate. We allow sharing from free/busy times only -- NOT DETAILS. However, it is still withholding the Secure Score points and flagging this suggestion. Anyone else seeing this? Do not allow Exchange Online calendar details to be shared with external users General Implementation Action plan

Allowed individual sharing, but limited to free/busy times. Description

Users should not be allowed to share the full details of their calendars with external users.

Xuyan Ding - MSFT 7,601 Reputation points

2023-04-24T02:08:00.9933333+00:00

This is a quick note to let you know that we are performing research on this issue.
DO-2233 15 Reputation points

2023-05-01T17:26:58.81+00:00

Ran into this today too.
In the end I left the policy enabled and set as Free/Busy only, and then chose "Resolved through alternate mitigation"
According to: https://learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-secure-score-improvement-actions?view=o365-worldwide

"Resolved through third party and Resolved through alternate mitigation - The recommended action has already been addressed by a third-party application or software, or an internal tool. You'll gain the points that the action is worth, so your score better reflects your overall security posture."
ADM-Griffin2, Jay 151 Reputation points

2023-05-01T17:35:54.7666667+00:00

I did the same. It would be nice if there was an easier way to report these. There are at least 4 others that are not accurate. I got one reported and it is supposed to be fixed this month, but it was PAINFUL to report.

3 answers

Your answer

Xuyan Ding - MSFT 7,601 Reputation points

2023-04-24T02:08:00.9933333+00:00

This is a quick note to let you know that we are performing research on this issue.
DO-2233 15 Reputation points

2023-05-01T17:26:58.81+00:00

Ran into this today too.
In the end I left the policy enabled and set as Free/Busy only, and then chose "Resolved through alternate mitigation"
According to: https://learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-secure-score-improvement-actions?view=o365-worldwide

"Resolved through third party and Resolved through alternate mitigation - The recommended action has already been addressed by a third-party application or software, or an internal tool. You'll gain the points that the action is worth, so your score better reflects your overall security posture."
ADM-Griffin2, Jay 151 Reputation points

2023-05-01T17:35:54.7666667+00:00

I did the same. It would be nice if there was an easier way to report these. There are at least 4 others that are not accurate. I got one reported and it is supposed to be fixed this month, but it was PAINFUL to report.

Answer 1

ADM-Griffin2, Jay 151

@Xuyan Ding - MSFT Thank you for responding to my question. I understand your response. I am not trying to get too picky, but the Security Score warning says sharing "details". I am only sharing free/busy times, not "details". If MS determine sharing free/busy times is also a risk it would be appropriate to re-word the Security Score measurement so it does not limit to details (but ALL calendar sharing). If sharing free/busy times only is secure, then the criteria for the Secure Score should be altered to not regress points when only free/busy times are shared.

User's image

Xuyan Ding - MSFT 7,601 Reputation points

2023-04-27T08:21:17.3033333+00:00

Thanks for your feedback, I understand your concerns. However, the current calculation of Security Score is by design, and calendars shared with external users will have this suggestion.
Duncan Drury 35 Reputation points

2024-02-20T10:00:27.7333333+00:00

The interface doesn't even correspond to the suggested actions anymore: The recommended actions need to be updated to match what the interface now shows.
Steve Logan 0 Reputation points

2024-03-15T11:33:33.15+00:00

@Duncan Drury So that box should be checked? The exact opposite of what they suggest when they say to make sure all boxes should be unchecked?
Duncan Drury 35 Reputation points

2024-03-15T13:10:06.3333333+00:00

Ticking the box shown in the interface just allows selection of the policy so you can select and delete multiple policies all at once. The same goes for the settings within the policy. It doesn't matter whether the box is ticked or not. It doesn't enable or disable anything.The security score and guidance don't seem to have any relation to what you should do and how it is achieved in the current configuration options.

Furthermore, the heading in the sharing section refers to sharing with federated Exchange organisations. If I have chosen to Federate with another Exchange organisation why would I not want to share calendar details with people in that organisation?

Federated Exchange Organisation might be sort of external, but it is quite specific, and doesn't include all the non-Federated Exchange Organisations in the world or indeed everyone else.

The secure score documentation and the labelling on this page need to be a lot clearer - I get the feeling even within Microsoft there is not shared understanding of what this setting is for.
Steve Logan 0 Reputation points

2024-03-15T13:12:52.9666667+00:00

Thanks. I ended up digging in to that default policy and the "uncheck" actually seems to be much deeper down into that policy than what those instructions imply. It's really annoying when a company gives "step by step" that are either incorrect, or outdated because the UI got overhauled and now the instructions are meaningless.
Duncan Drury 35 Reputation points

2024-03-15T13:24:36.0333333+00:00

There is a lot of that going on - the documentation team clearly cannot keep up with the amount of changes to the UI. It is possible that to get the security score points you need to delete the Default Sharing Policy completely, or delete all the "domains" from inside it. I don't think ticking or unticking those boxes has an effect either - the checkbox is to speed up editing or deleting.

But as I added to my comment above - this really seems to be a disconnect since the Policy seems to relate to Federated Exchange Organisations rather than the rest of the world that the security score item seems to be concerned with.

Answer 2

Isaiah Minor 5

The location at which Microsoft recommends implementing this action seems to be inaccurate. The correct location is in the admin.microsoft.com center and then clicking Settings > Org Settings. In the services area you will select Calendar and proceed to untick "Let users share their calendars with people outside of your organization who Office 365 or Exchange."

Ben Jenkins 0 Reputation points

2025-02-20T16:08:06.3133333+00:00

Hi @Isaiah Minor - Can you verify that changing this here provided you the Secure Score points? I would not be surprised if this is the case - these things need some more transparency to them.
Isaiah Minor 5 Reputation points

2025-02-20T18:15:51.05+00:00

Yes, I have 5/5 points.

Answer 3

Xuyan Ding - MSFT 7,601

Hi @ADM-Griffin2, Jay ,

If you have calendars that are shared with external users, this advice is expected behavior and is intended to remind you that an Individual sharing policy is being applied by your organization. User's image

User's image

For security purposes, administrators can sometimes choose to disable a user's sharing policy to prevent external access to the calendar. You can try to untick all the policies in Individual Sharing and look again at the recommended actions in Microsoft Secure Score, it will not show the suggestions in the picture above. Note that it may take up to 24 hours for scores to update.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

DO-2233 15 Reputation points

2023-05-01T17:17:37.2566667+00:00

I'm not sure you're following what he original poster is saying. :)

MS says we should disable the policy to prevent disclosing "full details". Except, like the OP, we too are NOT disclosing anything except Free/Busy details.

This rule (or perhaps just the wording on it) need to be fixed to address if it's "Full details" or "ANY details", that are the concern. Right now the solution suggests 'Any details' is too much.
ADM-Griffin2, Jay 151 Reputation points

2023-05-01T17:24:27.26+00:00

Thank you -- EXACTLY! Either the wording is incorrect or the criteria for the evaluation is incorrect.

Share via

Do not allow Exchange Online calendar details to be shared with external users

3 answers

Your answer