Outlook Meeting Cancellation Sends Immediate Email Without Confirmation, Exposing Recipient Addresses

Hi Amanda

Thank you for reaching out to the Microsoft Q&A forum and sincerely apologize for the inconvenience you're experiencing.

Based on your description, I understand that when cancelling a meeting created from an iCal invite in Outlook Desktop, Outlook sends a cancellation email to all attendees without prompting for confirmation. Additionally, the cancellation email discloses all attendee email addresses in the To/CC fields, which can lead to the unintended exposure of sensitive or external contacts.

Here is a recommended solution you can try to enable a confirmation prompt before sending cancellations:

• Open Outlook's VBA editor (Alt + F11). 
• In the Project Explorer, expand "Microsoft Outlook Objects" > "ThisOutlookSession". 
• Paste and adapt the following code (based on similar task-deletion scripts, modified for the calendar): 

    Private WithEvents CalendarItems As Items
    Private Sub Application_Startup()
       Dim objNS As NameSpace
       Set objNS = Application.GetNamespace("MAPI")
       Set CalendarItems = objNS.GetDefaultFolder(olFolderCalendar).Items
    End Sub
    Private Sub CalendarItems_ItemRemove()
       ' This event fires after removal, so it can't prevent; use BeforeDelete if available
    End Sub
    Private Sub CalendarItems_BeforeDelete(ByVal Item As Object, Cancel As Boolean)
       Dim strPrompt As String
       strPrompt = "Are you sure you want to cancel and send notifications for this meeting?"
       If MsgBox(strPrompt, vbYesNo + vbQuestion) = vbNo Then
           Cancel = True  ' Prevent deletion/cancellation
       Else
           ' Proceed with cancellation
           Cancel = False
       End If
    End Sub
  

• Save, close the editor, and restart Outlook.
• Then, try right clicking a meeting and selecting Cancel Meeting again to see if the confirmation appears. 

Regarding data exposure in cancellation emails (where all recipients see others' addresses in To/CC fields), this is also expected if the original meeting invite didn't use privacy features. To mitigate, enable the "Hide attendee list" option when creating the meeting: In the meeting window, go to Meeting > Response Options > Hide attendee list. This prevents recipients from seeing each other's emails in both the invite and subsequent updates/cancellations. For existing meetings, you'd need to recreate them with this enabled. Note that iCal invites imported into Outlook may not retain this setting automatically, so apply it manually post-import. 

Currently, there is no official Microsoft article that explicitly identifies this as a "limitation" or known issue for incident reporting. However, the following sources can be referenced to document the default behavior. 

• Cancel a meeting (describes the cancellation process without a prompt).
• Outlook options (Advanced) (covers calendar settings but confirms no prompt option exists).

Hope my answer can help you. If you have additional information, let me know in the comment section. I'll follow up and assist you as soon as possible! 

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".     

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.