External sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization

Contributed by -MynsterAll contributors →

Part of CISA · SharePoint · External sharing · All checks

Run this check

Invoke-Maester -TestId CISA.MS.SHAREPOINT.1.2

Overview

External sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization.

Rationale: Restricting OneDrive sharing reduces the risk of unauthorized data exposure from individual user storage. Allowing broad external sharing of OneDrive content increases the attack surface.

Remediation action:

1. Sign in to the SharePoint admin center.
2. Select Policies > Sharing.
3. Adjust external sharing slider for OneDrive to Existing guests or Only people in your organization.
4. Select Save.

Related links

• CISA 1 OneDrive Sharing - MS.SHAREPOINT.1.2v1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.SHAREPOINT.1.2
Severity	Medium
Suite	CISA
Product	SharePoint
Feature	External sharing
Area	External access and sharing
Resource type	Tenant
User impact	High
Implementation cost	Medium
MITRE ATT&CK	T1048 Exfiltration Over Alternative Protocol, T1213.002 Sharepoint, T1530 Data from Cloud Storage
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.SHAREPOINT.1.2
Criticality	SHALL
Upstream requirement	MS.SHAREPOINT.1.2v1
Supports controls	cisa-scuba:MS.SHAREPOINT.1.2, nist-800-53-r5:AC-2, nist-800-53-r5:AC-3, nist-800-53-r5:IA-8
PowerShell test	Test-MtCisaSpoOneDriveSharing
Services	SharePointOnline

Source

• Test: tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.1.2.ps1
• Documentation: tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.1.2.md