How to stop auto accepting invites from External Senders

Question

How to stop auto accepting invites from External Senders

Justin Formosa 20

I would like to remove the ability for meeting invites to be auto-accepted for my environment. We are seeing an uptick in malicious actors exploiting this. They will send a calendar invite for a meeting. When you delete it; it does NOT remove it from your calendar and it has a malicious link for the meeting.

There needs to be a away to prevent this from exploiting our users.

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hi @Justin Formosa

Thank you for posting your question in Microsoft Q&A.

We sincerely apologize for the inconvenience this may have caused to your work. As my research, the setting that controls this behavior is AutomateProcessing. This might set to AutoUpdate for user mailboxes, which means it processes invites and adds them to the calendar as "Tentative." You might need to change this to None.

When set to None, meeting invitations will only appear in the user's inbox. Nothing will be added to their calendar unless they manually click Accept, Tentative, or Decline. Deleting the email from the inbox will remove the invite completely, which is the behavior you want.

You could follow these steps to troubleshoot it via PowerShell:

Connect to ExchangeOnline

Run this command:

Get-Mailbox -ResultSize Unlimited | ForEach-Object {     
Write-Host "Disabling auto calendar processing for:" $_.PrimarySmtpAddress     
Set-CalendarProcessing $_.Identity -AutomateProcessing None }

Additionally, Microsoft’s article Use mail flow rules to automatically add meetings to calendars outlines how mail flow rules can be used to manage calendar invites. While these rules cannot block calendar invites entirely, they can be configured to detect meeting requests from external senders and take actions such as quarantining, redirecting, or deleting the message. However, this method may impact legitimate calendar traffic, so it’s recommended to implement allowlists for trusted domains or senders.

You can refer via: How to prevent calendar invites from external sources automatically appearing in calendar globally …

Please understand that our initial reply may not always immediately resolve the issue. However, with your help and more detailed information, we can work together to find a solution.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Accept answer 1 answer