Information
You should not allow your users to share the full details of their calendars with external users.
Rationale:
Attackers often spend time learning about your organization before launching an attack. Publicly available calendars can help attackers understand organizational relationships and determine when specific users may be more vulnerable to an attack, such as when they are traveling.
Impact:
This functionality is not widely used. As a result, it is unlikely that implementation of this setting will cause an impact to most users. Users that do utilize this functionality are likely to experience a minor inconvenience when scheduling meetings or synchronizing calendars with people outside the tenant.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
To disable calendar details sharing with external users, use the Microsoft 365 Admin Center:
Select Admin Center and Click to expand Settings.
Click Org settings.
Click Calendar.
Uncheck Let your users share their calendars with people outside of your organization who have Office 365 or Exchange.
Click Save.
To disable calendar details sharing with external users policy, use the Exchange Online PowerShell Module:
Connect to Exchange Online using Connect-ExchangeOnline.
Run the following Exchange Online PowerShell command:
Set-SharingPolicy -Identity 'Name of the policy' -Enabled $False
Default Value:
On