Rec: 1.3.3 - Validate Test-ExternalSharingCalendars.ps1, ELevel: E3, ProfileLevel: L2, IG1: FALSE, IG2: TRUE, IG3: TRUE, Connection: EXO

[DrIOSX]

Validation for Test-ExternalSharingCalendars.ps1

Recommendation Details

• Recommendation: 1.3.3
• Description: Ensure 'External sharing' of calendars is not available
• ELevel: E3
• Profile Level: L2
• CIS Control: 4.8
• CIS Description: Uninstall or Disable Unnecessary Services on Enterprise Assets and Software
• Implementation Group 1: FALSE
• Implementation Group 2: TRUE
• Implementation Group 3: TRUE
• Automated: TRUE
• Connection: EXO

Test-ExternalSharingCalendars.ps1

Tasks

Validate recommendation details

• [ ] Confirm that the recommendation details are accurate and complete as per the CIS benchmark.

Validate test for a pass

• [ ] Confirm that the automated test results align with the manual audit steps outlined in the CIS benchmark.
  • Specific conditions to check:
  • Condition A: In the Microsoft 365 admin center, external calendar sharing is disabled.
  • Condition B: Using the Exchange Online PowerShell Module, the OrganizationConfig property ExternalSharingEnabled is set to False.

Validate test for a fail

• [ ] Confirm that the failure conditions in the automated test are consistent with the manual audit results.
  • Specific conditions to check:
  • Condition A: In the Microsoft 365 admin center, external calendar sharing is enabled.
  • Condition B: Using the Exchange Online PowerShell Module, the OrganizationConfig property ExternalSharingEnabled is set to True.

Add notes and observations

• [ ] Compare the automated audit results with the manual audit steps and provide detailed observations.
  • Automated audit produced info consistent with the manual audit test results? (Yes/No)
  • Without disclosing any sensitive information, document any discrepancies between the actual output and the expected output.
  • Document any error messages, removing any sensitive information before submitting.
  • Identify the specific function, line, or section of the script that failed, if known.
  • Provide any additional context or observations that might help in troubleshooting.

If needed, the helpers folder in .\source\helpers contains a CSV to assist with locating the test definition.

[DrIOSX]

Base PowerShell Audit:

Get-SharingPolicy | Where-Object { $_.Domains -like '*CalendarSharing*' }

[DrIOSX]

Audit Mailboxes prior to disabling the feature globally:

$mailboxes = Get-Mailbox -ResultSize Unlimited 
foreach ($mailbox in $mailboxes) { 
    # Get the name of the default calendar folder (depends on the mailbox's language)
    $calendarFolder = string.Name 
    # Get users calendar folder settings for their default Calendar folder 
    # calendar has the format identity:\<calendar folder name>
    $calendar = Get-MailboxCalendarFolder -Identity "$($mailbox.PrimarySmtpAddress):\$calendarFolder" 
    if ($calendar.PublishEnabled) { 
        Write-Host -ForegroundColor Yellow "Calendar publishing is enabled for $($mailbox.PrimarySmtpAddress) on $($calendar.PublishedCalendarUrl)"
    }
}