Check ID:
Provider: Microsoft 365
Service:
Severity: HIGH
Categories:
Resource type:
sharepoint_external_sharing_restrictedProvider: Microsoft 365
Service:
sharepointSeverity: HIGH
Categories:
internet-exposed, identity-access, e3Resource type:
NotDefinedWhat this check verifies
Microsoft 365 SharePoint org-wide external sharing is evaluated to ensure it excludes anonymous ‘Anyone’ links and is restricted to authenticated guests viaExternalUserSharingOnly, ExistingExternalUserSharingOnly, or fully Disabled.
Risk
Anonymous or overly permissive sharing enables uncontrolled link access, eroding confidentiality and accountability. With edit links, integrity can be altered by unknown parties. Forwarded links and caching complicate revocation, increasing data exfiltration and long-lived exposure.Recommendation
Set org-level sharing toExternalUserSharingOnly or stricter (ExistingExternalUserSharingOnly/Disabled). Apply least privilege with default links scoped to SpecificPeople, enforce Microsoft Entra B2B guest authentication, limit domains, require link expiration, block guest resharing, and monitor via audit logs.
Remediation
- CLI
- Dashboard steps
Set-SPOTenant -SharingCapability ExternalUserSharingOnly
References
- https://learn.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off
- https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenant?view=sharepoint-ps
Where this check fires
This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable byCheck ID = sharepoint_external_sharing_restricted. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks