Detections
Analytics

7.2.6 Ensure SharePoint external sharing is restricted

Information

The external sharing features of SharePoint and OneDrive let users in the organization share content with people outside the organization (such as partners, vendors, clients, or customers). It can also be used to share between licensed users on multiple Microsoft 365 subscriptions if your organization has more than one subscription.

The recommended state is Limit external sharing by domain > Allow only specific domains

Attackers will often attempt to expose sensitive information to external entities through sharing, and restricting the domains that users can share documents with will reduce that surface area.

Solution

To remediate using the UI:

 - Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint.
 - Expand Policies > Sharing.
 - Expand More external sharing settings and check Limit external sharing by domain.
 - Select Add domains, choose Allow only specific domains, enter the list of approved domain names, and select Done.
 - Click Save at the bottom of the page.

To remediate using PowerShell:

 - Connect to SharePoint Online using Connect-SPOService.
 - Run the following PowerShell command:

Set-SPOTenant -SharingDomainRestrictionMode AllowList -SharingAllowedDomainList "domain1.com domain2.com"

Impact:

Users will be unable to initiate new shares with parties whose domains are not on the approved allowlist, which may require administrative action before collaboration with new partners or vendors can begin. Administrators must keep the allowlist current to reflect active business relationships; an outdated list can block legitimate sharing and generate support requests. Note that existing shares to domains not on the allowlist are not revoked when this setting is configured.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|13.4, CSCv7|14.6

Plugin: microsoft_azure

Control ID: c7ed3840375815c869225a5a95d5b931e15677f3d2442a55261b6827822bc866