What this check looks at
Checks whether people can share their calendars with people outside the organisation at all (the default sharing policy is on), as CIS asks for it to be off.
Exchange Online’s Default Sharing Policy decides what people can share of their calendars with people outside the organisation. Out of the box it is on: anyone can share their calendar with any external domain, and publish it to a web link that anyone who has the link can open, choosing for themselves how much detail to include.
The check reads the Default Sharing Policy and passes when it is turned off or lists no domains. It fails when the policy is enabled with any domain entries, so people can share or publish calendars outside the organisation; the evidence shows the policy’s entries.
A calendar shared outside, or published to a link that gets passed around, tells an attacker when the finance director is on leave, when the managing director is travelling and who meets whom. That timing is what makes an urgent payment request sent while the boss is on a plane convincing.
Why it matters
Even free/busy times shared outside show when people are away and who is in the office, which helps targeted fraud. CIS asks for external calendar sharing to be turned off unless there is a business need.
Invoice and CEO fraud work best when the person being impersonated cannot be reached. A published calendar showing the managing director on annual leave abroad is an invitation: the attacker emails the accounts team from a lookalike address that afternoon asking for an urgent supplier payment, knowing nobody can check in person.
Calendars also hold personal data (medical appointments, interview candidates, client names), so an overshared calendar can be a confidentiality breach in its own right. Turning sharing off costs nothing for most organisations; where a partner genuinely needs free/busy times, a named domain can go in a separate policy.
CIS Microsoft 365 Foundations Benchmark 1.3.3 asks for external sharing of calendars to be unavailable. NIST CSF 2.0 PR.DS-01, ISO 27001 A.5.14 (information transfer), CIS Controls v8 3.3 and NCSC CAF B3.c (stored data) all cover limiting what leaves the organisation.
How to fix it
Where: Microsoft 365 admin centre → Settings → Org settings → Calendar
Before you start
- Ask whether anyone shares a calendar with a partner or a personal address; agree an alternative (an invitation, or free/busy for a named partner domain).
Step by step
- Find out who shares today. Ask the client whether anyone shares a calendar with a partner, a personal address or a published link (assistants, consultants, room calendars). In Exchange Online PowerShell, Get-SharingPolicy | Format-List Name, Enabled, Domains, Default shows the policies, and Get-EXOMailbox -ResultSize Unlimited -Properties SharingPolicy | Where-Object SharingPolicy | Format-Table UserPrincipalName, SharingPolicy shows mailboxes on another policy.
- Turn off external calendar sharing in the admin centre. In the Microsoft 365 admin centre, go to Settings > Org settings, select Calendar on the Services tab, untick the option that lets users share their calendars with people outside the organisation, and select Save. This disables the Default Sharing Policy.
- Or turn it off in PowerShell. Connect with Connect-ExchangeOnline and run Set-SharingPolicy -Identity "Default Sharing Policy" -Enabled $false. External shares and published calendar links that exist already stop working.
- Give a genuine partner its own policy. If a named partner needs free/busy times, create a separate policy rather than reopening the default: New-SharingPolicy -Name "Partner free/busy" -Domains "partner.co.uk:CalendarSharingFreeBusySimple" -Enabled $true, then Set-Mailbox -Identity user@contoso.com -SharingPolicy "Partner free/busy" for only the people who need it.
- Confirm the change. Run Get-SharingPolicy -Identity "Default Sharing Policy" | Format-List Enabled and check it shows False. In Outlook on the web, sharing a calendar with an external address should no longer be offered. The next assessment passes.
With PowerShell
Set-SharingPolicy -Identity "Default Sharing Policy" -Enabled $false
What users will notice
People can no longer share or publish their calendar outside the organisation; sharing set up already stops working.
How to confirm it worked
Get-SharingPolicy -Identity "Default Sharing Policy" shows Enabled as False.
Frameworks and controls
This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.c Stored data |
| DSPT | Standard 1: Personal confidential data |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Data |
| SOC 2 | CC6.7 Restricting the transmission, movement and removal of information |
| NIST SP 800-171 | 3.1.20 Verify and control connections to external systems |
| CMMC Level 2 | AC.L2-3.1.20 External Connections |
| ISO 27001:2022 | A.5.14 Information transfer |
| CIS M365 | 1.3.3 Ensure 'External sharing' of calendars is not available |
| CIS Controls v8.1 | 3.3 Configure data access control lists (IG1) |
| NIST CSF 2.0 | PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Share calendars with external users (Microsoft Learn)