Outlook: Change the organizer of a meeting

🚨 The Signal: Meeting organizers can now transfer ownership of meetings, including recurring series, to another user. This feature helps maintain meeting continuity but introduces a new vector for social engineering and unauthorized control over organizational communications.

The Impact

All users are affected, with a moderate risk of social engineering leading to unauthorized meeting control and potential information exposure.

• End Users: Risk of social engineering to trick users into transferring meeting ownership.
• Security Teams: Need to monitor for suspicious meeting transfer activities.
• Compliance Teams: Potential for unauthorized information sharing if meeting control is compromised.
• IT Admins: Need to understand the audit trail for meeting ownership changes.

The Action

1. Educate users on social engineering tactics related to meeting transfer requests.
2. Review Exchange Online audit logs for 'Update-CalendarEvent' operations with 'Organizer' property changes.
3. Consider implementing communication policies around meeting ownership transfers.
4. Monitor for unusual meeting transfer patterns via Microsoft 365 Defender or Purview audit logs.

Domain: Exchange · Impact: medium · Workload: Exchange Online