External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization

Contributed by Michael Soule with 2 co-contributorsAll contributors →

Part of CISA · SharePoint · External sharing · All checks

Run this check

Invoke-Maester -TestId CISA.MS.SHAREPOINT.1.1

Overview

External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization.

Rationale: Sharing information outside the organization via SharePoint increases the risk of unauthorized access. By limiting external sharing, administrators decrease the risk of access to information.

Remediation action:

1. Sign in to the SharePoint admin center.
2. Select Policies > Sharing.
3. Adjust external sharing slider for SharePoint to Existing guests or Only people in your organization.

⚠️ WARNING: This will break existing sharing.

4. Select Save.

Related links

• CISA 1 External Sharing - MS.SHAREPOINT.1.1v1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.SHAREPOINT.1.1
Severity	Medium
Suite	CISA
Product	SharePoint
Feature	External sharing
Area	External access and sharing
Resource type	Tenant
User impact	High
Implementation cost	Medium
MITRE ATT&CK	T1048 Exfiltration Over Alternative Protocol, T1213.002 Sharepoint
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.SHAREPOINT.1.1
Criticality	SHALL
Upstream requirement	MS.SHAREPOINT.1.1v1
Supports controls	cisa-scuba:MS.SHAREPOINT.1.1, nist-800-53-r5:AC-2, nist-800-53-r5:AC-3, nist-800-53-r5:IA-8
PowerShell test	Test-MtCisaSpoSharing
Services	SharePointOnline

Source

• Test: tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.1.1.ps1
• Documentation: tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.1.1.md