What this check looks at
Checks that the default Outlook on the web policy stops people adding personal email accounts to the new Outlook for Windows and connecting personal calendars in Outlook on the web.
Outlook can hold more than the work mailbox. The new Outlook for Windows lets people add personal email accounts, such as Outlook.com, Gmail or Yahoo, beside the corporate one, and Outlook on the web lets them connect a personal Outlook.com or Google calendar. Both are allowed by default, through two settings on the Outlook on the web mailbox policy: PersonalAccountsEnabled and PersonalAccountCalendarsEnabled.
The check reads the default Outlook on the web mailbox policy and passes when both settings are off. It fails when either is on, naming which, and reports partly checked or not checked when Exchange Online did not return a setting. As CIS asks, it judges only the default policy; people given another policy are not covered, and their policies can be reviewed separately.
Mail in a personal account is outside every control the tenant has: no malware scanning, Safe Links, data loss prevention or audit log. With both accounts in one window, moving a document or a thread from the work mailbox to a personal one is a drag and drop, and nothing records where it went. The settings do not reach classic Outlook for Windows, Outlook for Mac or the mobile apps, which need controls of their own.
Why it matters
A personal mailbox sitting next to the work one in Outlook is one drag away from company data leaving, and it brings in mail that skipped the tenant’s malware scanning, Safe Links and data loss prevention.
A member of staff about to join a competitor adds their Gmail account to Outlook “to keep everything in one place”, then drags the client list and the last quarter’s proposals across. No mail leaves through Exchange, so no transport rule or DLP policy applies, and nothing in the tenant shows where the files went. When the tenant finds out, they cannot show what was taken.
The reverse matters too: a phishing message that reaches the personal inbox skipped the tenant’s filtering but is read in the same trusted window as work mail. Turning the settings off costs nothing and is quick to undo; the only friction is for people who already added a personal account, who are told to remove it.
CIS Microsoft 365 Foundations Benchmark v7.0.0 6.3.2 asks for both settings to be off in the default policy. CIS Controls v8 3.3 and 4.8, ISO 27001 A.5.14 (information transfer) and NCSC CAF B3 cover controlling where organisational data can go.
How to fix it
Before you start
- Tell staff, and the helpdesk, that personal email accounts and calendars will stop working in Outlook; personal mail stays available in a browser.
Step by step
- Tell people first. Let staff know that personal email accounts and calendars will stop working in Outlook, and that personal mail stays available in a browser or another app. Anyone who has already added a personal account will see a message asking them to remove it, so warn the helpdesk too.
- Check which policy people have. Connect with Connect-ExchangeOnline and run Get-OwaMailboxPolicy | Format-Table Name, IsDefault, PersonalAccountsEnabled, PersonalAccountCalendarsEnabled. Then run Get-CASMailbox -ResultSize Unlimited | Group-Object OwaMailboxPolicy | Format-Table Name, Count to see who has a policy other than the default.
- Turn both settings off in the default policy. Run Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -PersonalAccountsEnabled $false -PersonalAccountCalendarsEnabled $false, using the name of the default policy from the previous step if it differs. The change can take up to an hour to reach Outlook.
- Decide about the other policies. CIS only asks for the default policy. For each other policy from the second step, ask the tenant whether its people should be able to add personal accounts; usually the answer is no, and the same Set-OwaMailboxPolicy command with that policy’s name turns it off.
- Cover the other Outlook apps. The settings apply to the new Outlook for Windows and Outlook on the web only. For Outlook on phones, an Intune app configuration policy in organisation allowed accounts mode (IntuneMAMAllowedAccountsOnly, with IntuneMAMUPN), alongside an app protection policy, limits Outlook to work accounts. Classic Outlook for Windows and Outlook for Mac need their own controls.
- Confirm the setting. Run Get-OwaMailboxPolicy | Where-Object { $_.IsDefault } | Format-List PersonalAccountsEnabled, PersonalAccountCalendarsEnabled and check both are False. The next assessment passes.
With PowerShell
Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -PersonalAccountsEnabled $false -PersonalAccountCalendarsEnabled $false
What users will notice
People cannot add personal email accounts to the new Outlook for Windows or connect personal calendars in Outlook on the web. Anyone who already did is asked to remove the account.
How to confirm it worked
Get-OwaMailboxPolicy | Where-Object { $_.IsDefault } shows PersonalAccountsEnabled and PersonalAccountCalendarsEnabled as False.
Frameworks and controls
This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.c Stored data |
| DSPT | Standard 1: Personal confidential data |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Data |
| SOC 2 | CC6.7 Restricting the transmission, movement and removal of information |
| NIST SP 800-171 | 3.1.20 Verify and control connections to external systems |
| CMMC Level 2 | AC.L2-3.1.20 External Connections |
| ISO 27001:2022 | A.5.14 Information transfer |
| CIS M365 | 6.3.2 Ensure the ability to add personal email accounts and calendars is disabled |
| CIS Controls v8.1 | 3.3 Configure data access control lists (IG1)4.8 Uninstall or disable unnecessary services on enterprise assets and software (IG2) |
| NIST CSF 2.0 | PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Set-OwaMailboxPolicy (Microsoft Learn)