How to prevent calendar invites from external sources automatically appearing in calendar globally

Kloubek Michal 26 Reputation points
2025-09-17T09:43:23.62+00:00

Hi,
there's lot of phishing lately that isn't detected by MS spam filters.
These show up in user calendar automatically usually with phishing link
Since they are ineffective, simple solution is to disable automatic calendar processing globally. I see that it's possible to do per user basis via Set-CalendarProcessing .

Is there some more elegant solution in Exchange online that can affect whole tennant instead of single user?

Exchange Online
Exchange Online
A cloud-based service included in Microsoft 365, delivering scalable messaging and collaboration features with simplified management and automatic updates.
0 comments No comments
{count} votes

Answer accepted by question author
  1. Kudos-Ng 10,550 Reputation points Microsoft External Staff Moderator
    2025-09-17T10:12:51.6833333+00:00

    Hi Kloubek Michal

    Thank you for posting your question in the Microsoft Q&A forum.  

    Currently, Exchange Online does not offer a native tenant-wide setting to disable automatic calendar processing. However, with the PowerShell cmdlet shared earlier, you can extend it to perform a bulk update across all mailboxes in your tenant.

    Here’s how you can do it:

    Get-Mailbox -ResultSize Unlimited | ForEach-Object {
        Write-Host "Disabling auto calendar processing for:" $_.PrimarySmtpAddress
        Set-CalendarProcessing $_.Identity -AutomateProcessing None
    }
    

    This command loops through every mailbox and applies the AutomateProcessing None setting, effectively disabling automatic calendar handling such as auto-accepting or tentatively adding meeting invites. The execution time depends on the number of mailboxes—typically a few minutes for small tenants and longer for larger environments.

    Additionally, Microsoft’s article Use mail flow rules to automatically add meetings to calendars outlines how mail flow rules can be used to manage calendar invites. While these rules cannot block calendar invites entirely, they can be configured to detect meeting requests from external senders and take actions such as quarantining, redirecting, or deleting the message. However, this method may impact legitimate calendar traffic, so it’s recommended to implement allowlists for trusted domains or senders.
    I hope this help! If you have any further questions, please feel free to let me know.

    Best regards,


    If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".         

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
  1. Vasil Michev 123.6K Reputation points MVP Volunteer Moderator
    2025-09-17T10:02:14.71+00:00

    There is no way to toggle this on every user in one go, if that's what you are asking. Well, you can easily do this in bulk for all users via PowerShell, but I suppose that's not what you are asking?

    You can use a Mail flow rule to silently remove any external calendar invitation messages instead. Go to the EAC > Mail flow > Rules and create a new rule. Use The message properties > Include the message type condition and select Calendaring for the value. Add another condition to ensure only external senders will be affected (The sender is > external/internal). Add additional conditions and exceptions as needed, as I'm sure you have plenty of valid scenarios where users must still receive external invitations. Set the action to Block the message > delete the message without notifying anyone.

    User's image

    The above is just an example, you can use any set of conditions and actions that make sense to your scenario. For example, you can require moderator approval before releasing the message to the intended recipient, instead of outright deleting them.

    3 people found this answer helpful.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.