CIS.M365.1.3.9 - (L1) Ensure shared bookings pages are restricted to select users
Overview
Creating shared Bookings pages is limited to selected users, or Microsoft Bookings is turned off for the organisation.
A shared Bookings page publishes a scheduling page on the internet that lets outsiders book time with staff and shows availability. Anyone can create one by default, so pages that disclose staff names and calendars, or that are used for phishing with a trusted Microsoft domain, can appear without IT knowing.
The test passes when Bookings is disabled for the organisation, or when the default Outlook on the web policy no longer lets users create Bookings mailboxes. Selected users can then be given a policy that allows it.
Remediation action
- Sign in to the Microsoft 365 admin center.
- Go to Settings > Org settings > Services > Bookings.
- Select Allow only selected staff to be bookable and Require Bookings pages to be created by an administrator, or clear Allow Bookings to be turned on.
- Select Save.
- If Bookings stays on, connect with
Connect-ExchangeOnlineand runSet-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -BookingsMailboxCreationEnabled $false. The test reads this setting on the default policy, so set it even if you used the admin center options. - To let selected users create pages, run
New-OwaMailboxPolicy -Name BookingsCreators, then runSet-CASMailbox -Identity <user> -OwaMailboxPolicy BookingsCreatorsfor each user. The test does not check which users have that policy.
Related links
- Microsoft 365 admin center - Bookings settings
- Manage Microsoft Bookings in your organization
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 1.3.9
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.1.3.9 |
| Severity | Low |
| Suite | CIS |
| Product | Microsoft 365 |
| Feature | Organization settings |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566 Phishing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 1.3.9 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:1.3.9, nist-800-53-r5:AC-3 |
| PowerShell test | Test-MtCisSharedBookingsRestricted |
| Services | ExchangeOnline |
Source
- Test:
tests/cis/Test.CIS.M365.1.3.9.ps1 - Documentation:
tests/cis/Test.CIS.M365.1.3.9.md