Security | OWA | Allow to Disable export contact via Set-OwaMailboxPolicy
Using OWA can export all contacts from a user and use those contacts to send a phishing mail, this can be done in less than 1 minute if the account was compromised.
Please allow disabling exporting contacts tenant wide, per group, per user.
Right now if you go to https://outlook.office.com/people, there is a Manage button where can export all contacts. It would be great to disable this.