Clarification on AutomateProcessing Behavior for User, Shared, and Resource Mailboxes in Exchange Online

Question

Hello,

I’m reviewing our organization’s calendar security configuration and would like clarification on how the AutomateProcessing parameter behaves across different mailbox types in Exchange Online.

Specifically, I have a few questions:

User Mailboxes

Documentation indicates that user mailboxes default to AutoUpdate and that this value cannot be changed. → Can you confirm that administrators cannot modify user mailboxes to use None or AutoAccept in Exchange Online? → If not possible, are there any recommended alternatives for preventing automatic processing of calendar invites for user mailboxes (e.g., using transport rules, client-side settings, or policy controls)?

Resource Mailboxes

  It appears resource mailboxes created in the **EAC** or via **PowerShell after November 15, 2018**, default to `AutoAccept`, while older mailboxes may use `AutoUpdate`. → Can you confirm whether these values can be manually changed to `None` if needed for security testing? → Are there any known side effects of disabling automatic processing for resource mailboxes, such as meeting request handling or room booking workflows?
  
  **Shared Mailboxes / Shared Calendars**
  
     Can you provide guidance on how `AutomateProcessing` applies to **shared mailboxes or shared calendars**? → Do they follow the same default behavior as resource mailboxes or user mailboxes? → Are there best practices for managing unsolicited calendar invitations (such as ICS phishing) in shared or delegated calendars?
     

Thank you for your time and assistance. I want to ensure our configuration hardens against unwanted or malicious calendar invites without disrupting legitimate scheduling workflows.

Answer 1

In Exchange Online, the behavior of the AutomateProcessing parameter varies across different mailbox types:

User Mailboxes

• User mailboxes default to AutoUpdate, and this value cannot be changed to None or AutoAccept. Administrators are unable to modify this setting.
• To prevent automatic processing of calendar invites for user mailboxes, alternatives include using transport rules, client-side settings, or policy controls. However, specific recommendations for these alternatives are not detailed in the provided context.

Resource Mailboxes

• Resource mailboxes created in the Exchange Admin Center (EAC) or via PowerShell after November 15, 2018, default to AutoAccept. Older mailboxes may still use AutoUpdate.
• It is not specified whether these values can be manually changed to None for security testing, but typically, resource mailboxes are designed to automate processing for efficiency in booking workflows.
• Disabling automatic processing for resource mailboxes could lead to issues with meeting request handling and room booking workflows, as the automation is intended to streamline these processes.

Shared Mailboxes / Shared Calendars

• The context does not explicitly state how AutomateProcessing applies to shared mailboxes or shared calendars. However, it can be inferred that they may follow similar behavior as resource mailboxes, given their shared nature.
• Best practices for managing unsolicited calendar invitations, such as ICS phishing, in shared or delegated calendars are not detailed in the provided context, but it is generally advisable to implement strict access controls and educate users about recognizing phishing attempts.

Overall, careful consideration should be given to the configuration of calendar processing settings to balance security and functionality in scheduling workflows.

---

References:

• Manage resource mailboxes in Exchange Online
• Set-CalendarProcessing

Answer 2

Hello Samuel,

I got your questions about Exchange Online calendar security and AutomateProcessing, it's smart to worry about malicious invites.

Here's the deal with AutomateProcessing for different mailboxes:

User mailboxes: They're stuck on AutoUpdate you can't change it. To block auto-processing try mail flow rules to catch dodgy invites from outside your org. But be careful or you might mess up normal scheduling training users is also key.

Resource mailboxes: Ones made after late 2018 are AutoAccept, older ones might be AutoUpdate. You can switch AutomateProcessing to None with PowerShell for testing or extra security. But turning off auto-processing might screw up room booking so think about that.

Shared mailboxes/calendars: It's not set in stone, but they're usually like user mailboxes. You can tweak them like resource mailboxes with PowerShell and set AutomateProcessing to None. This might change how people use the calendar. Limit who can use it watch what's happening on the calendar and tell people how to spot bad invites.

To suggest the best setup what does your company use shared calendars for and do you depend on automatic booking?

I hope this answer is helpful if you have further questions feel free to reply back

Regards,

Marcelo