# (L1) Ensure shared bookings pages are restricted to select users
Creating shared Bookings pages is limited to selected users, or Microsoft Bookings is turned off for the organisation.
Source: https://maester.dev/docs/tests/CIS.M365.1.3.9
Part of CIS · Microsoft 365 · Organization settings · All checks
```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.1.3.9
```
## Overview
Creating shared Bookings pages is limited to selected users, or Microsoft Bookings is turned off for the organisation.
A shared Bookings page publishes a scheduling page on the internet that lets outsiders book time with staff and shows availability. Anyone can create one by default, so pages that disclose staff names and calendars, or that are used for phishing with a trusted Microsoft domain, can appear without IT knowing.
The test passes when Bookings is disabled for the organisation, or when the default Outlook on the web policy no longer lets users create Bookings mailboxes. Selected users can then be given a policy that allows it.
#### Remediation action
1. Sign in to the [Microsoft 365 admin center](https://admin.microsoft.com).
2. Go to **Settings** > **Org settings** > **Services** > [**Bookings**](https://admin.microsoft.com/#/Settings/Services/:/Settings/L1/Bookings).
3. Select **Allow only selected staff to be bookable** and **Require Bookings pages to be created by an administrator**, or clear **Allow Bookings to be turned on**.
4. Select **Save**.
5. If Bookings stays on, connect with `Connect-ExchangeOnline` and run `Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -BookingsMailboxCreationEnabled $false`. The test reads this setting on the default policy, so set it even if you used the admin center options.
6. To let selected users create pages, run `New-OwaMailboxPolicy -Name BookingsCreators`, then run `Set-CASMailbox -Identity -OwaMailboxPolicy BookingsCreators` for each user. The test does not check which users have that policy.
#### Related links
* [Microsoft 365 admin center - Bookings settings](https://admin.microsoft.com/#/Settings/Services/:/Settings/L1/Bookings)
* [Manage Microsoft Bookings in your organization](https://learn.microsoft.com/microsoft-365/bookings/turn-bookings-on-or-off)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 1.3.9](https://www.cisecurity.org/benchmark/microsoft_365)
## Details
Every attribute of this check
| Field | Value |
| --- | --- |
| Test ID | CIS.M365.1.3.9 |
| Severity | Low |
| Suite | CIS |
| Product | Microsoft 365 |
| Feature | Organization settings |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566 Phishing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 1.3.9 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:1.3.9, nist-800-53-r5:AC-3 |
| PowerShell test | [Test-MtCisSharedBookingsRestricted](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.1.3.9.ps1) |
| Services | ExchangeOnline |
## Source
- Test: [`tests/cis/Test.CIS.M365.1.3.9.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.1.3.9.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.1.3.9.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.1.3.9.md)
