Outlook: Change the organizer of meetings

🚨 The Signal: Outlook meetings can now transfer organizer ownership, including recurring series. This maintains meeting continuity during staff changes but introduces new considerations for data access and meeting control, particularly for online meetings and associated artifacts.

The Impact

Users can transfer meeting ownership, creating a risk of unauthorized access to meeting data if not managed during offboarding.

• Offboarding users: Risk of unmanaged transfer of sensitive meeting data if not explicitly handled.
• New organizers: May gain access to historical meeting chats and files without explicit consent or review.
• Delegates: Can initiate transfers, increasing the attack surface for unauthorized meeting control.
• Help desk: Requires new procedures for managing meeting ownership changes and associated data.

The Action

1. Review and update offboarding procedures to include explicit guidance for meeting organizer transfers.
2. Communicate to users the implications of accepting meeting organizer roles, especially regarding access to historical data.
3. Assess current delegate permissions to ensure they align with organizational policy for meeting management.
4. Develop internal guidance for help desk teams on managing meeting ownership changes and data access.
5. Monitor future announcements for Phase 2 and 3 regarding online meeting artifacts and update policies accordingly.

Domain: Exchange · Impact: medium · Workload: Exchange Online