# (L1) Ensure the ability to add personal email accounts and calendars is disabled

The default Outlook on the web mailbox policy does not allow connecting personal email accounts and personal calendars.

Source: https://maester.dev/docs/tests/CIS.M365.6.3.2

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Exchange Online · Outlook · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.6.3.2
```

## Overview

The default Outlook on the web mailbox policy does not allow connecting personal email accounts and personal calendars.

When a user connects a personal mail account, company and private mail mix in one inbox, and content can be moved or copied between them without any of your data protection controls applying. Mail from the personal account is also not filtered by your anti-phishing protection, which makes it a way to deliver malicious content.

Disabling the setting prevents users from adding the accounts in Outlook on the web and the new Outlook.

#### Remediation action

1. Connect to Exchange Online with `Connect-ExchangeOnline`.
2. Run `Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -PersonalAccountsEnabled $false -PersonalAccountCalendarsEnabled $false`. CIS requires this setting only on the default policy; this test does not evaluate custom policies. If you want the same protection for users assigned to a custom policy, configure that policy separately.
3. Check the setting with `Get-OwaMailboxPolicy | Format-List Identity, IsDefault, PersonalAccountsEnabled, PersonalAccountCalendarsEnabled`.

#### Related links

* [Set-OwaMailboxPolicy](https://learn.microsoft.com/powershell/module/exchange/set-owamailboxpolicy)
* [Outlook on the web mailbox policies](https://learn.microsoft.com/exchange/clients-and-mobile-in-exchange-online/outlook-on-the-web/outlook-web-app-mailbox-policies)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 6.3.2](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.6.3.2 |
| Severity | Low |
| Suite | CIS |
| Product | Exchange Online |
| Feature | Outlook |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1566 Phishing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 6.3.2 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:6.3.2, nist-800-53-r5:AC-20 |
| PowerShell test | [Test-MtCisPersonalAccountsDisabledInOutlook](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.3.2.ps1) |
| Services | ExchangeOnline |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.6.3.2.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.3.2.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.6.3.2.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.6.3.2.md)