M365EXO-022: Calendar detail sharing not open to all domains (MS.EXO.6.2)
- Plataforma
- Entra ID / M365
- Categoría
- Advanced Threat Protection
- Severidad
- Medium
- Pilar de Zero Trust
- Data (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
SCuBA MS.EXO.6.2 requires that calendar details not be shared with all domains. Sharing policies can permit external calendar detail sharing; a rule covering the wildcard domain (*) exposes meeting subjects, locations, and attendee information to any external party. This leaks organizational activity that supports targeted phishing and physical reconnaissance.
Valor recomendado
No sharing policy rule grants calendar detail sharing (CalendarSharing*) to the wildcard domain (*); sharing limited to specific approved domains, ideally free/busy only
Remediación
Review every Exchange Online sharing policy and remove any rule that shares calendar details with the wildcard domain (*). If external calendar sharing is required, restrict it to specific named domains and prefer free/busy-only levels over full detail. Confirm the default sharing policy does not expose calendar details to all domains.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- MS.EXO.6.2v1
- NIST SP 800-53
- AC-4, AC-21
- MITRE ATT&CK
- T1087