Back to Checks
m365

External calendar sharing is disabled at the organization level

admincenter_external_calendar_sharing_disabled
Service: admincenterSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposedtrust-boundariese5
Resource Type:NotDefined

Microsoft 365 calendar sharing is evaluated at the organization level to determine if sharing with external recipients is disabled, including blocking anonymous access and links sent outside the tenant.

Prowler logoProwlerprowler-provider-m365

Risk

Allowing external calendar sharing exposes meeting metadata (subjects, locations, attendees, patterns), weakening confidentiality. Adversaries can profile staff, craft convincing spear-phish or fake invites, time fraud attempts, and stage meeting hijacks, increasing BEC and social engineering success.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks admincenter_external_calendar_sharing_disabled

Recommendation

Apply least privilege: disable external calendar sharing tenant-wide. If business-needed, allow only approved domains, require authenticated recipients (no anonymous), and limit details to Free/Busy (time only). Review sharing policies regularly under zero trust and defense in depth.

Remediation

CLI

Set-SharingPolicy -Identity "Default Sharing Policy" -Enabled $false

Other

1Go to https://admin.microsoft.com and sign in
2Navigate to Settings > Org settings > Services > Calendar
3Under External sharing, uncheck "Let your users share their calendars with people outside of your organization who have Microsoft 365 or Exchange"
4Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.admincenter.admincenter_client import (
    admincenter_client,
)


class admincenter_external_calendar_sharing_disabled(Check):
    """
    Ensure that external calendar sharing is disabled for the organization.

    Disabling external calendar sharing restricts the ability for users to share their
    calendars externally in Microsoft 365. This prevents users from sending calendar
    sharing links to external recipients, reducing information exposure.

    Attributes:
        metadata: Metadata associated with the check (inherited from Check).
    """

    def execute(self) -> List[CheckReportM365]:
        """
        Execute the check for external calendar sharing in Microsoft 365.

        This method checks if external calendar sharing is disabled in the organization configuration.

        Returns:
            List[CheckReportM365]: A list of reports containing the result of the check.
        """
        findings = []
        sharing_policy = admincenter_client.sharing_policy
        if sharing_policy:
            report = CheckReportM365(
                metadata=self.metadata(),
                resource=sharing_policy,
                resource_name=sharing_policy.name,
                resource_id=sharing_policy.guid,
            )
            report.status = "FAIL"
            report.status_extended = (
                "External calendar sharing is enabled at the organization level."
            )

            if not sharing_policy.enabled:
                report.status = "PASS"
                report.status_extended = (
                    "External calendar sharing is disabled at the organization level."
                )

            findings.append(report)

        return findings

References