Detections
Analytics

7.2.8 Ensure external sharing is restricted by security group

Information

External sharing of content can be restricted to specific security groups. This setting is global, applies to sharing in both SharePoint and OneDrive and cannot be set at the site level in SharePoint.

Without restricting external sharing to designated security groups, any user in the organization can share SharePoint or OneDrive content with external recipients. A compromised or insider-threat account can exfiltrate sensitive data by sharing files externally without additional authorization controls. Limiting external sharing to members of specific Entra ID security groups ensures that only reviewed and authorized users have this capability, reducing the attack surface for data exfiltration through sharing.

Solution

To remediate using the UI:

 - Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint
 - Expand Policies > Sharing.
 - Scroll to and expand More external sharing settings.
 - Set the following:

 - Check Allow only users in specific security groups to share externally
 - Click Manage security groups, then add at least one security group authorized for external sharing.

To remediate using PowerShell:

 - Connect to SharePoint Online using Connect-SPOService.
 - Run the following command, replacing <GroupObjectId> with the GUID of the security group to be authorized for external sharing:

Set-SPOTenant -WhoCanShareAuthenticatedGuestAllowList "<GroupObjectId>"

Note: To authorize multiple security groups, provide a comma-delimited list of Object IDs: "<GroupObjectId1>","<GroupObjectId2>".

Note: Users in the designated security groups must also be permitted to invite guests in Microsoft Entra. Verify this at Identity > External Identities > External collaboration settings.

Impact:

Users who are not members of the designated security groups will lose the ability to create new external shares or invite new external guests. Existing sharing links they previously established will remain active for current recipients. Organizations should ensure the security groups are populated with appropriate members before enabling this setting to avoid inadvertently blocking all external sharing. Helpdesk volume may increase as users in non-designated groups encounter sharing restrictions.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION

References: 800-53|AC-2, 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|AC-6(1), 800-53|AC-6(7), 800-53|AU-9(4), 800-53|MP-2

Plugin: microsoft_azure

Control ID: a686e7a18fe3dffc6fedf482529e2f887dcbbad5542fcec48b13cd527b32c962