Detections
Analytics

7.2.2 Ensure SharePoint and OneDrive integration with Azure AD B2B is enabled

Information

Entra ID B2B provides authentication and management of guests. Authentication happens via one-time passcode when they don't already have a work or school account or a Microsoft account. Integration with SharePoint and OneDrive allows for more granular control of how guest user accounts are managed in the organization's AAD, unifying a similar guest experience already deployed in other Microsoft 365 services such as Teams.

Note: Global Reader role currently can't access SharePoint using PowerShell.

External users assigned guest accounts will be subject to Entra ID access policies, such as multi-factor authentication. This provides a way to manage guest identities and control access to SharePoint and OneDrive resources. Without this integration, files can be shared without account registration, making it more challenging to audit and manage who has access to the organization's data.

Solution

To remediate using PowerShell:

 - Connect to SharePoint Online using Connect-SPOService
 - Run the following command:

Set-SPOTenant -EnableAzureADB2BIntegration $true

Impact:

After enabling Microsoft Entra B2B integration, external users attempting to access previously shared links (One Time Passcode) will encounter access issues. They receive error 'This organization has updated its guest access settings'. To restore access, your users need to reshare files/folders/sites to external users.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b.

Plugin: microsoft_azure

Control ID: d9ae3a9c3181ab21c6a68dbde356cad19b1ea8a4624627f566a7a16a2fb721dc