What this check looks at
Checks that the default Outlook on the web policy stops everyone creating shared Bookings pages, leaving it to selected people.
Microsoft Bookings lets people create shared booking pages where customers pick a time with the business or a team. Each shared Bookings page has its own scheduling mailbox, with an account in Entra ID, and can be published to anyone on the internet, collecting names, email addresses, phone numbers and answers to custom questions. By default the Outlook on the web mailbox policy lets every licensed user create one.
The check reads the default Outlook on the web mailbox policy (OwaMailboxPolicy-Default) and passes when BookingsMailboxCreationEnabled is off, so only people given another policy can create shared Bookings pages. It fails when the default policy lets everyone create them, and reports not checked when the setting was not returned.
Unmanaged booking pages mean public web forms collecting personal data under the company’s name that nobody in IT knows about, mailboxes that are in no leaver process, and staff names and availability published openly. They are rarely an attack route in themselves, but they are the kind of sprawl that surfaces after a data subject request or a complaint.
Why it matters
A shared Bookings page creates a mailbox and a public booking form under the company’s name. Letting anyone create one means public pages, and new mailboxes, that nobody manages.
A marketing assistant creates a public booking page for a webinar, asking for name, company, phone number and anything else attendees want to share. It collects a few hundred entries, the assistant leaves, and nobody owns the page or the data. When one attendee asks under UK GDPR what the business holds about them, nobody knows the page exists.
Limiting who can create pages keeps the feature for the teams that need it (reception, sales, support) while making sure each page has an owner, a privacy notice and a place in the leaver process. The change does not affect pages that already exist.
CIS Microsoft 365 Foundations Benchmark 1.3.9 asks for shared Bookings pages to be restricted to selected users. ISO 27001 A.5.14 (information transfer) and A.5.12 (classification of information), CIS Controls v8 3.3 and NCSC CAF B3.c cover controlling where data is collected and held.
How to fix it
Where: Microsoft 365 admin centre → Settings → Org settings → Bookings
Before you start
- List who uses shared Bookings pages today; give them an Outlook on the web policy that allows Bookings before the change.
Step by step
- List the people who need Bookings. Ask the client which teams use shared Bookings pages or will need them. In Exchange Online PowerShell, Get-EXOMailbox -RecipientTypeDetails SchedulingMailbox -ResultSize Unlimited | Format-Table DisplayName, PrimarySmtpAddress lists the existing booking mailboxes, which keep working after the change.
- Create a policy for the people who may create pages. Connect with Connect-ExchangeOnline and run New-OwaMailboxPolicy -Name "BookingsCreators", then Set-OwaMailboxPolicy -Identity BookingsCreators -BookingsMailboxCreationEnabled $true -AdditionalStorageProvidersAvailable $false. A new policy starts from Microsoft’s defaults, so copy any other setting you have changed on the default policy; third-party storage is the usual one and has its own check.
- Assign it to those people. For each person who may create shared Bookings pages, run Set-CASMailbox -Identity user@contoso.com -OwaMailboxPolicy BookingsCreators. The change can take a while to apply; they may need to sign out of Outlook on the web and back in.
- Turn it off for everyone else. Run Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -BookingsMailboxCreationEnabled $false. The Microsoft 365 admin centre offers the same restriction under Settings > Org settings > Services > Bookings, as the option to allow only selected users to create shared booking pages.
- Review the existing pages. For each booking mailbox from the first step, ask the client who owns it, whether it is still needed and whether its page has a privacy notice. Remove the ones nobody owns with Remove-Mailbox -Identity <booking mailbox> once the client agrees.
- Confirm the setting. Run Get-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default | Format-List BookingsMailboxCreationEnabled and check it is False, and Get-CASMailbox -Identity user@contoso.com | Format-List OwaMailboxPolicy for one of the selected people. The next assessment passes.
With PowerShell
Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -BookingsMailboxCreationEnabled $false
What users will notice
Only the selected people can create shared Bookings pages; existing pages keep working.
How to confirm it worked
Get-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default shows BookingsMailboxCreationEnabled as False.
Frameworks and controls
This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.c Stored data |
| DSPT | Standard 1: Personal confidential data |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Data |
| SOC 2 | CC6.7 Restricting the transmission, movement and removal of informationC1.1 Identifying and maintaining confidential information |
| NIST SP 800-171 | 3.1.22 Control CUI posted or processed on publicly accessible systems |
| CMMC Level 2 | AC.L2-3.1.22 Control Public Information |
| ISO 27001:2022 | A.5.14 Information transferA.5.12 Classification of information |
| CIS M365 | 1.3.9 Ensure shared bookings pages are restricted to select users |
| CIS Controls v8.1 | 3.3 Configure data access control lists (IG1) |
| NIST CSF 2.0 | PR.PS-01: Configuration management practices are established and applied |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Turn Bookings on or off (Microsoft Learn)