Detections
Analytics

1.3.9 (L1) Ensure shared bookings pages are restricted to select users

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Shared Bookings allows you to invite your team members and create booking pages and let your customers book time with you and your team. It contains various settings to define services, manage staff members, configure schedules and availability, business hours and customize how appointments are scheduled. These pages can be customized to fit the diverse needs of your organization. It is an extension of Person Bookings.

The recommended state is to restrict the OwaMailboxPolicy-Default policy or disable at the organization level.

Shared Bookings pages can be exploited by threat actors to impersonate legitimate users using convincing internal email addresses. A compromised low-privilege account could be used to mimic high-profile identities (e.g., the CEO) and bypass impersonation filters to initiate fraudulent actions like fund transfers.

Additionally, attackers may create authoritative-looking addresses (e.g., admin@, hostmaster@) to conduct social engineering attacks on external parties aimed at the transfer of infrastructure control.

To reduce this risk, access to Shared Bookings should be limited to users with a clear business need and subject to monitoring and governance.

Solution

To remediate using PowerShell:

 - Connect to Exchange Online using Connect-ExchangeOnline.
 - Run the following PowerShell command:
Set-OwaMailboxPolicy "OwaMailboxPolicy-Default" -BookingsMailboxCreationEnabled:$false

 Optionally: For a more restrictive state Bookings can be disabled at the organization level

 - Connect to Exchange Online using Connect-ExchangeOnline.
 - Run the following command:
Set-OrganizationConfig -BookingsEnabled $false

 Note: Disabling Bookings at the tenant (organization) level will be more impactful to end users and is not required for compliance.

Impact:

Disabling Shared Bookings will limit users' ability to create self-service scheduling pages, which may reduce convenience for teams that rely on automated meeting coordination. Approved users will need to be added to a separate OWA Policy which will increase administrative overhead.

 Note: Before modifying the default owa policy, ensure that any users who rely on Shared Bookings are assigned a separate policy that explicitly allows its use. This will help prevent unintended service disruptions.

See Also

https://workbench.cisecurity.org/benchmarks/24619

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

References: 800-53|AC-2, 800-53|AC-3, 800-53|AC-6, 800-53|AC-6(1), 800-53|AC-6(7), 800-53|AU-9(4)

Plugin: microsoft_azure

Control ID: e9fda8fb90107e8f8b29c7df7d72c0dfe398ecb0106ede34cba2ad6e879417d4