Control: 7.2.3 Ensure external content sharing is restricted
Description
The external sharing settings govern sharing for the organization overall. Each site has its own sharing setting that can be set independently, though it must be at the same or more restrictive setting as the organization.
The new and existing guests option requires people who have received invitations to sign in with their work or school account (if their organization uses Microsoft 365) or a Microsoft account, or to provide a code to verify their identity. Users can share with guests already in your organization's directory, and they can send invitations to people who will be added to the directory if they sign in.
The recommended state is New and existing guests or less permissive.
Remediation
To remediate using the UI:
- Navigate to
SharePoint admin centerhttps://admin.microsoft.com/sharepoint. - Click
Policies>Sharing. - Locate the
External sharing section. - Under SharePoint, move the slider bar to New and existing guests or a less permissive level.
- OneDrive will also be moved to the same level and can never be more permissive than SharePoint.
To remediate using PowerShell:
- Connect to SharePoint Online using
Connect-SPOService -Url https://[tenant]-admin.sharepoint.com. - Run the following cmdlet to establish the minimum recommended state:
Set-SPOTenant -SharingCapability ExternalUserSharingOnly
Note: Other acceptable values for this parameter that are more restrictive include: Disabled and ExistingExternalUserSharingOnly.
Default Value
Anyone (ExternalUserAndGuestSharing)
Usage
Run the control in your terminal:
powerpipe control run microsoft365_compliance.control.cis_v500_7_2_3Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run microsoft365_compliance.control.cis_v500_7_2_3 --shareSQL
This control uses a named query:
select tenant_id as resource, case when sharepoint_settings ->> 'sharing_capability' = 'externalUserAndGuestSharing' then 'alarm' else 'ok' end as status, case when sharepoint_settings ->> 'sharing_capability' = 'externalUserAndGuestSharing' then title || ' microsoft365 external content sharing unrestricted.' else title || ' external content sharing set to ' || (sharepoint_settings ->> 'sharing_capability') || '.' end as reason , tenant_id as tenant_idfrom microsoft365_organization;