How do I block LinkedIn from extracting data from Microsoft Exchange Server?

Question

LinkedIn now offers the ability to take a real user and password from the end user and connect to Exchange Server for the purpose of importing contacts into their system. (To do this yourself, click contacts.. add contacts)

My concern about this is that LinkedIn will not only have access to contacts, but also corporate email as well. (which may contain private or confidential information)

My second concern is that many multi factor authentication systems appear "compatible" with this solution, meaning that the LinkedIn is acting as a MITM

Question 1

How should I restrict this type of activity from occurring? What IP addresses should I block on the firewall from accessing my Exchange server?

Question 2

Obviously end users should be informed of this risk and be culturally adapted to not doing such a thing. What is an example communication should I send out that would educate users on not using their corporate credentials on 3rd party sites?

Answer 1

There are two different matters here, Outlook Social Connector LinkedIn integration and LinkedIn Outlook contact import. These are totally different things.

• Importing contacts from Microsoft Exchange: In this case, LinkedIn has no access to your Inbox at all. LinkedIn could indeed have access to the user's inbox. The whole process is controlled by an API provided by Microsoft Exchange itself, it's called Exchange Web Services (EWS). It's up to you to configure the access rights and information shared by EWS.

  You can block this by using the Set-OrganizationConfig cmdlet, then setting the EwsApplicationAccessPolicy value to EnforceBlockList and adding LinkedInEWS to your block list. Now your users won't be able to import their contacts and send them to LinkedIn.

• Outlook Social Connector LinkedIn integration: In this case, the core of the deal between Microsoft and LinkedIn was to provide social functionalists for Outlook, and to provide LinkedIn an access to millions of address books and inboxes in the corporate world. So if you don't want LinedIn to have access to your inbox, you shouldn't integrate LinkedIn with your Outlook Social Connector.

Answer 2

Answer 1) These applications do not arbitrarily connect unless they are given permission to connect. The method to "restrict" is to not allow access whenever it prompts you for access. You can try blocking an IP, but there is a likelihood you will only block yourself from being able to access LinkedIn as a whole. Aside from this, if they're using a CDN (Akamai, etc.) you'd need to block a variety of addresses.

Answer 2) Most corporate networks have security teams. Those security teams get their guidance from senior management. Policies may already be in place to alert users (guidelines, AUPs). If you feel that strongly about it, bring it up to management/