Default Sharing Policy

Question

Default Sharing Policy

Roger Roger 7,511

Hi All

Below is the current configuration of my default sharing policy:( i have just specified contoso.com as my domain)

Get-SharingPolicy | Select Name, Domains

Name                   Domains
----                   -------
Default Sharing Policy {*:CalendarSharingFreeBusySimple, Anonymous:CalendarSharingFreeBusySimple}


Get-SharingPolicy -Identity "Default Sharing Policy" | fl

Domains                : {*:CalendarSharingFreeBusySimple, Anonymous:CalendarSharingFreeBusySimple}
Enabled                : True
Default                : True
AdminDisplayName       :
ExchangeVersion        : 0.10 (14.0.100.0)
Name                   : Default Sharing Policy
DistinguishedName      : CN=Default Sharing Policy,CN=Federation,CN=Configuration,CN=contoso.onmicrosoft.com,CN=ConfigurationUnits,DC=EURPR05A001,DC=PROD,DC=OUTLOOK,DC=COM
Identity               : Default Sharing Policy
ObjectCategory         : EURPR05A001.PROD.OUTLOOK.COM/Configuration/Schema/ms-Exch-Sharing-Policy
ObjectClass            : {top, msExchSharingPolicy}
ExchangeObjectId       : 
OrganizationalUnitRoot : contoso.onmicrosoft.com
OrganizationId         : EURPR05A001.PROD.OUTLOOK.COM/Microsoft Exchange Hosted Organizations/contoso.onmicrosoft.com - EURPR05A001.PROD.OUTLOOK.COM/ConfigurationUnits/contoso.onmicrosoft.com/Configuration
Id                     : Default Sharing Policy
Guid                   : 
OriginatingServer      : 
IsValid                : True
ObjectState            : Changed

I have been advised to modify the default sharing policy to the below

To disable both "Anonymous" and  "all domains" sharing from the default sharing policy Microsoft 365 admin center->"Settings" -> "Org Settings"-> "Services" tab -> "Calendar" and uncheck "External sharing" checkboxes.

Alternatively, Go to Exchange Admin Center -> "Organization" -> "Sharing" -> below "Individual Sharing" there is a table with all of your organization sharing policies. 
find the "Default Sharing Policy" and double click to edit. 
Under Domains & share information click manage domains 
Find "Anonymous" and "Sharing with all domains" → edit and uncheck both "Share your contacts folder" and "Share your calendar folder"

I would like to understand the impact of this change.

What functionality will be affected after disabling:

I am looking to compare the current vs. proposed configuration and understand any potential user or business impact before proceeding.

Answer accepted by question author

1 additional answer

Your answer

Answer 1

Hi Roger Roger

From my observation, your current policy allows all users (who do not have a more specific policy assigned) to: 1. Share simple free/busy calendar information with external recipients in any federated domain via the *:CalendarSharingFreeBusySimple entry.1. Publish calendars via anonymous URLs accessible to anyone with the link via the Anonymous:CalendarSharingFreeBusySimple entry. The proposed change removes both of these permissions by unchecking "Share your calendar folder" and "Share your contacts folder" for each entry, effectively leaving the Domains attribute empty.Given this, the following will be affected:

External calendar sharing (all domains): Users will no longer be able to send sharing invitations that expose free/busy information to external recipients. Existing external sharing relationships governed by this policy will also stop working; recipients will see errors or an empty calendar view.
Anonymous calendar publishing: Users will no longer be able to publish calendars via shareable URLs. Any existing published links already distributed externally will stop returning data immediately.
External contact folder sharing: If currently permitted, users will no longer be able to share contact folders with external recipients under this policy.
Existing shares break retroactively: This change does not only prevent new shares; all currently active external calendar subscriptions and anonymous published URLs governed by this policy will stop providing data as soon as the policy is updated.

In the contrast, the following will not be affected:

Internal calendar sharing and free/busy lookup within your tenant remain fully functional, as these are controlled by mailbox folder permissions, not the external Sharing Policy.
Email flow (sending and receiving) and meeting invitations to external attendees will continue to work normally; recipients still receive invites.
Cross-tenant free/busy in hybrid or Teams scenarios is largely unaffected, as this is typically governed by Organization Relationships rather than individual Sharing Policies.

From my perspective view, I would recommend auditing current usage and notifying affected users before applying the change, and if cross-tenant free/busy is still needed for specific partner domains, consider configuring an Organization Relationship as a more secure, admin-controlled alternative.

You can read here for more information:

Modify, disable, or remove a sharing policy in Exchange Online

Sharing calendar and contacts in Microsoft 365

Hope my answer will help you.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Current configuration

The Default Sharing Policy currently has:

* : CalendarSharingFreeBusySimple
- Allows users to share simple free/busy information (availability only, no subject/location/details) with any external domain that is covered by your organization’s federation configuration.
Anonymous : CalendarSharingFreeBusySimple
- Allows users to publish calendars and share simple free/busy information with anonymous recipients (anyone with the link, typically via calendar publishing).

Because the policy is:

Enabled : True
Default : True

it applies to all mailboxes that do not have a more specific sharing policy assigned.

Proposed configuration

The proposed change is to edit the Default Sharing Policy and, for both:

“Sharing with all domains” (*)
“Anonymous”

uncheck:

“Share your calendar folder”
“Share your contacts folder”

Effectively this removes or disables the calendar/contact sharing actions for:

All external federated domains
Anonymous users (Internet users with a link)

Resulting behavior after the change

External calendar sharing to other organizations
- Today: Users can send sharing invitations that expose simple free/busy to external recipients in any domain allowed by federation and this policy.
- After change:
  - Users will no longer be able to share their calendars (even free/busy only) with external users via standard Exchange/Outlook calendar sharing.
  - Existing sharing relationships governed by this policy will stop working once the policy no longer permits the sharing level (recipients may see no data or errors when trying to view the shared calendar).
Anonymous calendar publishing
- Today: Users can publish calendars and share a URL that shows simple free/busy to anyone with the link, governed by the Anonymous: CalendarSharingFreeBusySimple rule.
- After change:
  - Users will no longer be able to publish calendars or use existing anonymous calendar URLs governed by this policy.
  - Existing published links will effectively be blocked from showing data once the policy no longer allows anonymous sharing.
External contact folder sharing
- If currently allowed by the policy (via “Share your contacts folder”):
  - Today: Users can share contact folders with external recipients.
  - After change: Users will no longer be able to share contact folders with external recipients under the Default Sharing Policy.
Internal calendaring and contacts
- No impact.
- Internal free/busy, calendar permissions, and contact access within the same tenant/organization are controlled by mailbox folder permissions and internal policies, not by the external sharing policy.
Mail flow and other Exchange features
- No impact on:
  - Sending/receiving email
  - Meeting invites to external users (they still receive invites; they just cannot subscribe to or view the sender’s calendar via policy-based sharing).

Business/user impact summary

Loss of external visibility:
- External partners, vendors, or customers who currently rely on viewing users’ free/busy via shared calendars or published links will lose that visibility.
Scheduling friction:
- Users will need to coordinate meetings with external parties via email, phone, or other tools instead of using shared calendars.
Existing links and shares:
- Any existing anonymous calendar URLs and external calendar sharing relationships governed by the Default Sharing Policy will stop providing data once the policy is tightened.

If external calendar/contact sharing is not a business requirement, the impact is minimal and primarily improves data protection. If external collaboration via calendar visibility is important, this change will be noticeable and may require alternative processes or tools.

References:

Share via

Default Sharing Policy

1 additional answer

Your answer