CIS.M365.6.3.2 - (L1) Ensure the ability to add personal email accounts and calendars is disabled

Contributed by jeremy finneyAll contributors →

Overview

The default Outlook on the web mailbox policy does not allow connecting personal email accounts and personal calendars.

When a user connects a personal mail account, company and private mail mix in one inbox, and content can be moved or copied between them without any of your data protection controls applying. Mail from the personal account is also not filtered by your anti-phishing protection, which makes it a way to deliver malicious content.

Disabling the setting prevents users from adding the accounts in Outlook on the web and the new Outlook.

Remediation action

1. Connect to Exchange Online with Connect-ExchangeOnline.
2. Run Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -PersonalAccountsEnabled $false -PersonalAccountCalendarsEnabled $false. CIS requires this setting only on the default policy; this test does not evaluate custom policies. If you want the same protection for users assigned to a custom policy, configure that policy separately.
3. Check the setting with Get-OwaMailboxPolicy | Format-List Identity, IsDefault, PersonalAccountsEnabled, PersonalAccountCalendarsEnabled.

Related links

• Set-OwaMailboxPolicy
• Outlook on the web mailbox policies
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.3.2

Test Metadata

Field	Value
Test ID	CIS.M365.6.3.2
Severity	Low
Suite	CIS
Product	Exchange Online
Feature	Outlook
Area	External access and sharing
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1566 Phishing
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.3.2
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:6.3.2, nist-800-53-r5:AC-20
PowerShell test	Test-MtCisPersonalAccountsDisabledInOutlook
Services	ExchangeOnline

Source

• Test: tests/cis/Test.CIS.M365.6.3.2.ps1
• Documentation: tests/cis/Test.CIS.M365.6.3.2.md