(L1) Ensure the ability to add personal email accounts and calendars is disabled
CIS.M365.6.3.2LowExchange OnlineOutlookPreview 3.0
Part of CIS · Exchange Online · Outlook · All checks
Invoke-Maester -TestId CIS.M365.6.3.2Overview
Section titled “Overview”The default Outlook on the web mailbox policy does not allow connecting personal email accounts and personal calendars.
When a user connects a personal mail account, company and private mail mix in one inbox, and content can be moved or copied between them without any of your data protection controls applying. Mail from the personal account is also not filtered by your anti-phishing protection, which makes it a way to deliver malicious content.
Disabling the setting prevents users from adding the accounts in Outlook on the web and the new Outlook.
Remediation action
Section titled “Remediation action”- Connect to Exchange Online with
Connect-ExchangeOnline. - Run
Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -PersonalAccountsEnabled $false -PersonalAccountCalendarsEnabled $false. CIS requires this setting only on the default policy; this test does not evaluate custom policies. If you want the same protection for users assigned to a custom policy, configure that policy separately. - Check the setting with
Get-OwaMailboxPolicy | Format-List Identity, IsDefault, PersonalAccountsEnabled, PersonalAccountCalendarsEnabled.
Related links
Section titled “Related links”- Set-OwaMailboxPolicy
- Outlook on the web mailbox policies
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.3.2
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | CIS.M365.6.3.2 |
| Severity | Low |
| Suite | CIS |
| Product | Exchange Online |
| Feature | Outlook |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566 Phishing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.3.2 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:6.3.2, nist-800-53-r5:AC-20 |
| PowerShell test | Test-MtCisPersonalAccountsDisabledInOutlook |
| Services | ExchangeOnline |
Source
Section titled “Source”- Test:
tests/cis/Test.CIS.M365.6.3.2.ps1 - Documentation:
tests/cis/Test.CIS.M365.6.3.2.md