What this check looks at
Checks the default Exchange sharing policy for calendar details or contacts shared with every external domain, or published anonymously.
Exchange Online sharing policies decide what people may share from their calendars and contacts with people outside the organisation. The Default Sharing Policy applies to every mailbox unless another is assigned. It has an entry for all domains (*) and optionally one for anonymous sharing (publishing a calendar by link), and each entry can share free/busy times only, free/busy with subject and location, all details, or contacts.
This check reads the Default Sharing Policy. The check fails when the all-domains entry shares more than free/busy times (calendar details, reviewer access or contacts). It warns when only the anonymous entry allows calendars to be published with details, and passes when only free/busy times are shared or sharing is off.
A calendar with details shows who is meeting whom, about what, where, and when people are away. Shared with every domain, or published to anyone with the link, it is a ready-made briefing for targeted fraud: the attacker knows when the finance director is on holiday and which deal is about to close.
Why it matters
Calendar details show who meets whom, when people are away and what deals are in progress: exactly what a targeted fraud needs. Sharing them with every domain, or by anonymous link, publishes that to anyone who asks.
The directors of a 50-person property developer publish their calendars with details so clients can book time. A fraudster reads that the managing director flies abroad on Thursday and a land purchase completes on Friday, then emails the conveyancing contact from a lookalike address, supposedly from the airport, with new completion account details.
Limiting external sharing to free/busy times keeps scheduling with other organisations working while giving away nothing useful. Named partners who need more can be added by domain.
CIS Microsoft 365 Foundations Benchmark 1.3.3 asks for external sharing of calendars not to be available, and CISA SCuBA MS.EXO.6.1 and MS.EXO.6.2 ask for contacts and calendar details not to be shared with all domains. CIS Controls v8 safeguard 3.3, ISO 27001 A.5.14 and A.5.12, the NCSC 10 Steps data security guidance and the NCSC CAF stored data outcome support it.
How to fix it
Where: Exchange admin centre → Organisation → Sharing
Before you start
- Ask whether any partner organisation needs calendar details; add that domain to the sharing policy by name instead of sharing with every domain.
Step by step
- Check the current policy. Connect to Exchange Online PowerShell and run Get-SharingPolicy | Format-List Name, Default, Enabled, Domains. Note the entries for * and Anonymous, and any named partner domains.
- Ask about partners. Ask the client whether any partner organisation needs to see calendar details. Those can keep a named-domain entry rather than detail being shared with everyone.
- Edit the policy in the Exchange admin centre. In the Exchange admin centre, go to Organisation > Sharing, Individual sharing tab, and open Default Sharing Policy. For sharing with all domains choose calendar free/busy information with time only and untick contacts. For Anonymous choose free/busy with time only, or remove the entry. Save.
- Or set it with PowerShell. Run Set-SharingPolicy -Identity "Default Sharing Policy" -Domains "*:CalendarSharingFreeBusySimple", "Anonymous:CalendarSharingFreeBusySimple", adding any named partner entries you are keeping (for example "partner.co.uk:CalendarSharingFreeBusyDetail"), because this replaces the whole list.
- Check other sharing policies. Run Get-Mailbox -ResultSize Unlimited | Group-Object SharingPolicy | Select-Object Name, Count to see whether any mailboxes use another policy, and review those in the same way.
- Confirm only free/busy is shared. Run Get-SharingPolicy -Identity "Default Sharing Policy" | Format-List Domains: no entry for * or Anonymous should include CalendarSharingFreeBusyDetail, CalendarSharingFreeBusyReviewer or ContactsSharing. The finding clears at the next assessment.
What users will notice
People outside the organisation see only free/busy times. Calendars already published with details by link show free/busy only from now on.
How to confirm it worked
Get-SharingPolicy shows no entry for * or Anonymous with CalendarSharingFreeBusyDetail, CalendarSharingFreeBusyReviewer or ContactsSharing.
Frameworks and controls
This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.c Stored data |
| DSPT | Standard 1: Personal confidential data |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Data |
| SOC 2 | CC6.7 Restricting the transmission, movement and removal of informationC1.1 Identifying and maintaining confidential information |
| NIST SP 800-171 | 3.1.22 Control CUI posted or processed on publicly accessible systems |
| CMMC Level 2 | AC.L2-3.1.22 Control Public Information |
| ISO 27001:2022 | A.5.14 Information transferA.5.12 Classification of information |
| CISA SCuBA | MS.EXO.6.1v1 Contact folders not shared with all domainsMS.EXO.6.2v1 Calendar details not shared with all domains |
| CIS M365 | 1.3.3 Ensure 'External sharing' of calendars is not available |
| CIS Controls v8.1 | 3.3 Configure data access control lists (IG1) |
| NIST CSF 2.0 | PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Sharing policies in Exchange Online (Microsoft Learn)