(L2) Ensure OneDrive content sharing is restricted

Contributed by jeremy finneyAll contributors →

Part of CIS · SharePoint · External sharing · All checks

Run this check

Invoke-Maester -TestId CIS.M365.7.2.4

Overview

OneDrive is the personal file storage of each user. When sharing from OneDrive is open, users can give files to anyone, including people outside the organization, and the owner of the file may not notice. Sensitive personal and work files then leave the tenant through links that are hard to track.

Turning off sharing from OneDrive means users can share their OneDrive files only inside the organization. Files that must reach external people can be moved to a SharePoint site where sharing is governed by the tenant policy.

Remediation action

1. Sign in to the SharePoint admin center.
2. Go to Policies > Sharing.
3. Under External sharing, set the OneDrive level to Only people in your organization.
4. Select Save.

To apply the setting with PowerShell, connect with Connect-PnPOnline -Url https://<tenant>-admin.sharepoint.com -Interactive and run the following command:

Set-PnPTenant -OneDriveSharingCapability Disabled

Related links

• SharePoint admin center
• Turn external sharing on or off
• Set-PnPTenant
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - 7.2.4

Details

Every attribute of this check

Field	Value
Test ID	CIS.M365.7.2.4
Severity	Medium
Suite	CIS
Product	SharePoint
Feature	External sharing
Area	External access and sharing
Resource type	Tenant
User impact	Medium
Implementation cost	Low
MITRE ATT&CK	T1213.002 Sharepoint, T1530 Data from Cloud Storage
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 7.2.4
Benchmark level	L2
Benchmark profiles	E3 Level 2
Supports controls	cis-m365:7.2.4, nist-800-53-r5:AC-21
PowerShell test	Test-MtCisOneDriveContentSharing
Services	SharePointOnline

Source

• Test: tests/cis/Test.CIS.M365.7.2.4.ps1
• Documentation: tests/cis/Test.CIS.M365.7.2.4.md