Org settings: Services

The Services tab under Settings > Org settings in the Microsoft 365 admin center. One tile per workload, each holding tenant-wide switches that apply to every licensed user at once: Calendar, Bookings, Forms, Sway, user-owned apps and services, and the rest. The ones with a security blast radius are documented below.

📅🧑‍💼OS - Calendar External Sharing

Disable the Default Sharing Policy so users can no longer hand a calendar URL to anyone outside the tenant, and route the legitimate cases through organization relationships or Bookings instead.

🛒🧑‍💼OS - User-Owned Apps and Services

Stop users acquiring Office Store add-ins, starting trials, and buying their own licenses on the org's behalf. Close the Store checkbox, kill self-service purchase per product, and route the apps you actually want through centralized deployment.