(L1) Ensure shared bookings pages are restricted to select users

Contributed by jeremy finneyAll contributors →

Part of CIS · Microsoft 365 · Organization settings · All checks

Run this check

Invoke-Maester -TestId CIS.M365.1.3.9

Overview

Creating shared Bookings pages is limited to selected users, or Microsoft Bookings is turned off for the organisation.

A shared Bookings page publishes a scheduling page on the internet that lets outsiders book time with staff and shows availability. Anyone can create one by default, so pages that disclose staff names and calendars, or that are used for phishing with a trusted Microsoft domain, can appear without IT knowing.

The test passes when Bookings is disabled for the organisation, or when the default Outlook on the web policy no longer lets users create Bookings mailboxes. Selected users can then be given a policy that allows it.

Remediation action

1. Sign in to the Microsoft 365 admin center.
2. Go to Settings > Org settings > Services > Bookings.
3. Select Allow only selected staff to be bookable and Require Bookings pages to be created by an administrator, or clear Allow Bookings to be turned on.
4. Select Save.
5. If Bookings stays on, connect with Connect-ExchangeOnline and run Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -BookingsMailboxCreationEnabled $false. The test reads this setting on the default policy, so set it even if you used the admin center options.
6. To let selected users create pages, run New-OwaMailboxPolicy -Name BookingsCreators, then run Set-CASMailbox -Identity <user> -OwaMailboxPolicy BookingsCreators for each user. The test does not check which users have that policy.

Related links

• Microsoft 365 admin center - Bookings settings
• Manage Microsoft Bookings in your organization
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 1.3.9

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.1.3.9
Severity	Low
Suite	CIS
Product	Microsoft 365
Feature	Organization settings
Area	External access and sharing
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1566 Phishing
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 1.3.9
Benchmark level	L1
Benchmark profiles	E3 Level 1
Supports controls	cis-m365:1.3.9, nist-800-53-r5:AC-3
PowerShell test	Test-MtCisSharedBookingsRestricted
Services	ExchangeOnline

Source

• Test: tests/cis/Test.CIS.M365.1.3.9.ps1
• Documentation: tests/cis/Test.CIS.M365.1.3.9.md