External sharing uses a domain allowlist or blocklist

​

What this check verifies

Microsoft 365 SharePoint external sharing uses domain-based restrictions via AllowList or BlockList. The evaluation inspects sharingDomainRestrictionMode and whether the corresponding domain list is populated, flagging when domain controls are missing or the selected list is empty.

​

Risk

Without enforced domain limits, users may share with personal or rogue domains, enabling data exfiltration and unauthorized persistence.

• Confidentiality: leaks of files and sites
• Integrity: unvetted collaborators can alter content
• Availability: takeovers can disrupt shared sites

​

Recommendation

Apply least privilege by enforcing domain-based sharing with a curated AllowList of trusted partners; use BlockList only to complement gaps.

• Review and attest lists regularly
• Use defense in depth: prefer authenticated, scoped links over public links and align with B2B governance and oversight.

​

Remediation

​

References

• https://learn.microsoft.com/en-us/sharepoint/restricted-domains-sharing
• https://learn.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off
• https://blog.admindroid.com/restrict-domain-sharing-in-sharepoint-online-and-onedrive/

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = sharepoint_external_sharing_managed. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks