Microsoft 365 settings enabled by default for newly created Engage communities

🚨 The Signal: Newly created Viva Engage communities will now automatically subscribe members to community emails and calendar invites. This increases communication by default but also expands potential vectors for information oversharing and targeted phishing within the organisation.

The Impact

Viva Engage community members and owners are affected, with a minor security risk of increased information exposure and phishing surface.

• Community members: Automatically subscribed to emails/calendars, increasing potential for unwanted information or phishing.
• Community owners: Must actively manage new default subscription settings to prevent oversharing.
• Security teams: Increased surface area for internal phishing campaigns via community communications.
• Admins: Need to inform users about new default settings and their implications.

The Action

1. Inform Viva Engage community owners that new communities will default to subscribing members to emails and calendar invites.
2. Advise community owners to review and adjust subscription settings for their communities via the My Account portal: https://myaccount.microsoft.com/groups/groups-i-own.

Domain: Other · Impact: medium · Workload: Other