# (L2) Ensure OneDrive content sharing is restricted

OneDrive is the personal file storage of each user. When sharing from OneDrive is open, users can give files to anyone, including people outside the…

Source: https://maester.dev/docs/tests/CIS.M365.7.2.4

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · SharePoint · External sharing · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.7.2.4
```

## Overview

OneDrive is the personal file storage of each user. When sharing from OneDrive is open, users can give files to anyone, including people outside the organization, and the owner of the file may not notice. Sensitive personal and work files then leave the tenant through links that are hard to track.

Turning off sharing from OneDrive means users can share their OneDrive files only inside the organization. Files that must reach external people can be moved to a SharePoint site where sharing is governed by the tenant policy.

#### Remediation action

1. Sign in to the [SharePoint admin center](https://admin.microsoft.com/sharepoint).
2. Go to **Policies** > **Sharing**.
3. Under **External sharing**, set the **OneDrive** level to **Only people in your organization**.
4. Select **Save**.

To apply the setting with PowerShell, connect with `Connect-PnPOnline -Url https://<tenant>-admin.sharepoint.com -Interactive` and run the following command:

```powershell
Set-PnPTenant -OneDriveSharingCapability Disabled
```

#### Related links

* [SharePoint admin center](https://admin.microsoft.com/sharepoint)
* [Turn external sharing on or off](https://learn.microsoft.com/sharepoint/turn-external-sharing-on-or-off)
* [Set-PnPTenant](https://pnp.github.io/powershell/cmdlets/Set-PnPTenant.html)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 7.2.4](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.7.2.4 |
| Severity | Medium |
| Suite | CIS |
| Product | SharePoint |
| Feature | External sharing |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Low |
| MITRE ATT&CK | T1213.002 Sharepoint, T1530 Data from Cloud Storage |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 7.2.4 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2 |
| Supports controls | cis-m365:7.2.4, nist-800-53-r5:AC-21 |
| PowerShell test | [Test-MtCisOneDriveContentSharing](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.7.2.4.ps1) |
| Services | SharePointOnline |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.7.2.4.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.7.2.4.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.7.2.4.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.7.2.4.md)