# External sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization

External sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization.

Source: https://maester.dev/docs/tests/CISA.MS.SHAREPOINT.1.2

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/mynster9361" title="-Mynster · Original author"><img src="https://github.com/Mynster9361.png" alt="-Mynster" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/mynster9361">-Mynster</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cisa">CISA</a> · SharePoint · External sharing · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CISA.MS.SHAREPOINT.1.2
```

## Overview

External sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization.

Rationale: Restricting OneDrive sharing reduces the risk of unauthorized data exposure from individual user storage. Allowing broad external sharing of OneDrive content increases the attack surface.

#### Remediation action:

1. Sign in to the [SharePoint admin center](https://go.microsoft.com/fwlink/?linkid=2185219).
2. Select Policies > Sharing.
3. Adjust external sharing slider for OneDrive to **Existing guests** or **Only people in your organization**.
4. Select Save.

#### Related links

* [CISA 1 OneDrive Sharing - MS.SHAREPOINT.1.2v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/sharepoint.md#mssharepoint12v1)
* [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/SharepointConfig.rego)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CISA.MS.SHAREPOINT.1.2 |
| Severity | Medium |
| Suite | CISA |
| Product | SharePoint |
| Feature | External sharing |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | High |
| Implementation cost | Medium |
| MITRE ATT&CK | T1048 Exfiltration Over Alternative Protocol, T1213.002 Sharepoint, T1530 Data from Cloud Storage |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.SHAREPOINT.1.2 |
| Criticality | SHALL |
| Upstream requirement | MS.SHAREPOINT.1.2v1 |
| Supports controls | cisa-scuba:MS.SHAREPOINT.1.2, nist-800-53-r5:AC-2, nist-800-53-r5:AC-3, nist-800-53-r5:IA-8 |
| PowerShell test | [Test-MtCisaSpoOneDriveSharing](https://github.com/maester365/maester/blob/main/tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.1.2.ps1) |
| Services | SharePointOnline |

</details>

## Source

- Test: [`tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.1.2.ps1`](https://github.com/maester365/maester/blob/main/tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.1.2.ps1)
- Documentation: [`tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.1.2.md`](https://github.com/maester365/maester/blob/main/tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.1.2.md)