Users should not be able to share their calendars with people outside the organization

Calendars show who meets whom, where people are and when they are away. Microsoft Learn states that if you change nothing, all users can invite anyone with an email address to view their calendar. A single shared calendar can therefore expose project names, customer visits, travel and out-of-office periods to outsiders, and the sharing happens at user level without an admin in the loop.

Exchange Online sharing policies control this. A policy lists the domains users may share with and the level of detail: free/busy time only, time with subject and location, or time with subject, location and title. An admin can also disable a user's sharing policy to prevent external access to calendars.

Source: Sharing policies in Exchange Online, Microsoft Learn.

In the Microsoft 365 admin center, go to Settings, then Org settings, then Services and Calendar. The option that lets users share calendars with people outside the organization should be off.

With Exchange Online PowerShell, this read-only command lists the sharing policies and the domains they allow:

Connect-ExchangeOnline -ShowBanner:$false
Get-SharingPolicy | Format-List Name, Enabled, Default, Domains

A policy whose Domains value contains an entry such as Anyone:CalendarSharingFreeBusySimple allows external sharing. Also run Get-Mailbox -ResultSize 10 | Format-Table Name, SharingPolicy on a test set to see which policy is applied to mailboxes.

In the admin center, open Settings, Org settings, Calendar and clear the option that allows sharing with external users, then save. Alternatively, restrict the sharing policy itself from PowerShell (review it, then run it yourself; ConfigCobra never changes your tenant):

Set-SharingPolicy -Identity "Default Sharing Policy" `
  -Domains @{Remove="Anyone:CalendarSharingFreeBusySimple"}

Remove each external entry that Get-SharingPolicy showed. If you want to keep sharing with a few partner domains, replace the wildcard with the named domains instead of removing everything.

Users can no longer send calendar invitations or publish links that give outsiders a view of their calendar. Calendars already shared externally may stop being visible to the recipients, so tell people who rely on them, such as executives who share availability with an outside assistant, before you switch it off.

Normal meeting invitations to external attendees still work; only calendar sharing and publishing are restricted. Collect the list of domains that have a business need first, so exceptions can be added back deliberately.