Default OWA mailbox policy disables personal account integration
The default Outlook on the web (OWA) mailbox policy should have PersonalAccountsEnabled and PersonalAccountCalendarsEnabled set to false. The former controls adding personal email accounts (e.g., Outlook.com, Gmail) in the new Outlook for Windows; the latter controls connecting personal Outlook.com or Google calendars in Outlook on the web.
ProwlerRisk
Allowing personal account integration lets corporate and personal data mix within the same client, increasing the risk of data leakage and reducing the organization's ability to govern and audit access to corporate mail and calendars.
Run this check with Prowler
Run in Prowler Cloudprowler m365 --checks exchange_owa_mailbox_policy_personal_accounts_disabledRecommendation
Disable PersonalAccountsEnabled and PersonalAccountCalendarsEnabled on the default OWA mailbox policy to prevent users from adding personal email accounts in the new Outlook for Windows and connecting personal calendars in Outlook on the web.
Remediation
CLI
Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -PersonalAccountsEnabled $false -PersonalAccountCalendarsEnabled $falseOther
Check Code
from typing import List
from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.exchange.exchange_client import exchange_client
class exchange_owa_mailbox_policy_personal_accounts_disabled(Check):
"""Check if the default OWA mailbox policy disables personal account integration.
Outlook on the web mailbox policies expose PersonalAccountsEnabled, which
controls whether users can add personal email accounts in the new Outlook for
Windows, and PersonalAccountCalendarsEnabled, which controls whether users can
connect personal Outlook.com or Google calendars in Outlook on the web. Only
the default OWA mailbox policy is required for compliance with this control.
- PASS: The default OWA mailbox policy disables personal accounts and personal
account calendars.
- FAIL: The default OWA mailbox policy allows personal accounts and/or personal
account calendars.
"""
def execute(self) -> List[CheckReportM365]:
"""Execute the check for the default OWA mailbox policy personal account settings.
Returns:
List[CheckReportM365]: A list of reports containing the result of the check.
"""
findings = []
for mailbox_policy in exchange_client.mailbox_policies:
if not mailbox_policy or not mailbox_policy.is_default:
continue
report = CheckReportM365(
metadata=self.metadata(),
resource=mailbox_policy,
resource_name=f"Exchange Mailbox Policy - {mailbox_policy.id}",
resource_id=mailbox_policy.id,
)
report.status = "PASS"
report.status_extended = f"Default OWA mailbox policy '{mailbox_policy.id}' disables personal account integration."
allowed_settings = []
if mailbox_policy.personal_accounts_enabled:
allowed_settings.append("personal accounts")
if mailbox_policy.personal_account_calendars_enabled:
allowed_settings.append("personal account calendars")
if allowed_settings:
report.status = "FAIL"
report.status_extended = f"Default OWA mailbox policy '{mailbox_policy.id}' allows {' and '.join(allowed_settings)}."
findings.append(report)
return findings