Detections
Analytics
6.3.2 Ensure the ability to add personal email accounts and calendars is disabled
Information
Outlook on the web (OWA) mailbox policies include two settings that control personal account integration in Outlook. PersonalAccountsEnabled controls whether users can add personal email accounts (e.g., Outlook.com, Gmail, Yahoo) in the new Outlook for Windows. PersonalAccountCalendarsEnabled controls whether users can connect personal Outlook.com or Google calendars in Outlook on the web. Neither setting applies to classic Outlook for Windows, Outlook for Mac, or Outlook mobile apps.The recommended state for the default OWA Mailbox Policy is:
- PersonalAccountsEnabled is set to False
- PersonalAccountCalendarsEnabled is set to False
Personal email accounts are not subject to corporate security controls such as anti-malware scanning, data loss prevention (DLP), Safe Links, or audit logging. Allowing personal accounts alongside the corporate mailbox enables side-channel data exfiltration (e.g., forwarding sensitive content to a personal inbox) and creates an ingress path for malware and phishing payloads that bypass tenant mail-flow protections.
Solution
To remediate using PowerShell:- Connect to Exchange Online using Connect-ExchangeOnline.
- Run the following:
$DefaultPolicy = Get-OwaMailboxPolicy | Where-Object { $_.IsDefault }
Set-OwaMailboxPolicy -Identity $DefaultPolicy.Identity -PersonalAccountsEnabled $false -PersonalAccountCalendarsEnabled $false
Impact:
This control does not apply to classic Outlook for Windows, Outlook for Mac, or Outlook mobile apps. Organizations requiring broader coverage should evaluate additional controls like application management policies to restrict personal account usage on those clients. This also does not block users from accessing personal accounts via other email clients or web browsers.
Changes to OWA mailbox policies may take up to 60 minutes to take effect. If users previously added personal accounts before this policy was applied, those accounts will be disabled once the policy is detected, and affected users will see a message advising them to remove the personal account from Outlook, which may generate helpdesk inquiries.
The audit only applies to the default OWA mailbox policy. Users assigned to a non-default OWA mailbox policy are not covered; optionally, custom policies can be reviewed separately to ensure a level of enforcement beyond the compliance requirements of this control.
See Also
Item Details
Audit Name: CIS Microsoft 365 Foundations v7.0.0 L1 E5
Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION
References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|CM-6, 800-53|CM-7, 800-53|MP-2
Plugin: microsoft_azure
Control ID: dcd70147df08e59f4acb42a669f79734a71c6fb5c6104f4298fc6f915c9f4bd1