CIS.M365.7.2.8 - (L2) Ensure external sharing is restricted by security group

Contributed by jeremy finneyAll contributors →

Overview

When external sharing is turned on, every user who can share SharePoint and OneDrive content can also share it with people outside the organization. If an account is compromised, the attacker gets the same right and can send files to an outside address.

Limiting external sharing to members of specific security groups means only the people in those groups can share with external users. Other users can still work with their files and sites, but they cannot share them externally until they are added to a group. The members must also be allowed to invite guests in the Microsoft Entra external collaboration settings.

Remediation action

1. Create or choose a Microsoft Entra security group that contains the users who are allowed to share externally. Microsoft 365 groups are not accepted.
2. Sign in to the SharePoint admin center.
3. Go to Policies > Sharing.
4. Expand More external sharing settings.
5. Select Allow only users in specific security groups to share externally, then select Manage security groups.
6. Add the group (up to 12 groups can be added). Under Can share with, keep Authenticated guests only (the default). A group set to Anyone can also share Anyone links, which need no sign-in, so it does not satisfy this check. At least one group must be set to Authenticated guests only.
7. Select Save.

To apply the setting with PowerShell, connect with Connect-PnPOnline -Url https://<tenant>-admin.sharepoint.com -Interactive and run the following, replacing the placeholder with the object ID of your security group. The list you pass replaces the current one. The check reads this list, as the CIS PowerShell audit does. Groups in -WhoCanShareAnonymousAllowList (set to Anyone in the admin center) are shown in the results but do not count.

Set-PnPTenant -WhoCanShareAuthenticatedGuestAllowList '<group object id>'

Related links

• SharePoint admin center
• External sharing overview
• Allow only members in specific security groups to share SharePoint and OneDrive files and folders externally
• Set-PnPTenant
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 7.2.8

Test Metadata

Field	Value
Test ID	CIS.M365.7.2.8
Severity	Medium
Suite	CIS
Product	SharePoint
Feature	External sharing
Area	External access and sharing
Resource type	Tenant
User impact	Medium
Implementation cost	Medium
MITRE ATT&CK	T1213.002 Sharepoint, T1530 Data from Cloud Storage
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 7.2.8
Benchmark level	L2
Benchmark profiles	E3 Level 2
Supports controls	cis-m365:7.2.8, nist-800-53-r5:AC-21
PowerShell test	Test-MtCisSpoSharingSecurityGroup
Services	SharePointOnline

Source

• Test: tests/cis/Test.CIS.M365.7.2.8.ps1
• Documentation: tests/cis/Test.CIS.M365.7.2.8.md