Contact folders SHALL NOT be shared with all domains

Contributed by Michael Soule with Merill FernandoAll contributors →

Part of CISA · Exchange Online · Calendar and contact sharing · All checks

Run this check

Invoke-Maester -TestId CISA.MS.EXO.6.1

Overview

Contact folders SHALL NOT be shared with all domains.

Rationale: Contact folders may contain information that should not be shared by default with all domains. Disabling sharing with all domains closes an avenue for data exfiltration while still allowing for specific legitimate use as needed.

Remediation action:

To restrict sharing with all domains:

1. Sign in to the Exchange admin center.
2. On the left-hand pane under Organization, select Sharing.
3. Select Individual Sharing.
4. For all existing policies, select the policy, then select Manage domains.
5. For all sharing rules under all existing policies, ensure Sharing with everyone and Anonymous do not include ContactsSharing.

Related links

• Exchange admin center - Individual Sharing
• CISA 6 Calendar and Contact Sharing - MS.EXO.6.1v1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.EXO.6.1
Severity	Medium
Suite	CISA
Product	Exchange Online
Feature	Calendar and contact sharing
Area	External access and sharing
Resource type	Policy
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1048 Exfiltration Over Alternative Protocol, T1567 Exfiltration Over Web Service
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.EXO.6.1
Criticality	SHALL
Upstream requirement	MS.EXO.6.1v1
Supports controls	cisa-scuba:MS.EXO.6.1, nist-800-53-r5:AC-3, nist-800-53-r5:SC-7(10)(a)
PowerShell test	Test-MtCisaContactSharing
Services	ExchangeOnline

Source

• Test: tests/cisa/exchange/Test.CISA.MS.EXO.6.1.ps1
• Documentation: tests/cisa/exchange/Test.CISA.MS.EXO.6.1.md