Restrict SharePoint external sharing to authenticated guests

Description

The organization-level external sharing level for SharePoint is at most {{ sharepoint_sharing_level }}: Anyone links are not available, so every external recipient authenticates as a guest.

Levels, from most to least permissive: Anyone (ExternalUserAndGuestSharing), New and existing guests (ExternalUserSharingOnly), Existing guests (ExistingExternalUserSharingOnly), Only people in your organization (Disabled). The baseline allows new and existing guests; the hardened profile only allows guests already in the directory, so inviting a new external person goes through the guest invitation process.

Each site can be set more restrictive than the organization level, never more permissive.

Rationale

An Anyone link is a bearer token: whoever has the URL gets the content, including after the link is forwarded, posted in a ticket or indexed by a mail gateway. No identity is recorded, so the access cannot be audited, revoked per person or covered by Conditional Access. Requiring guests to authenticate keeps every external access tied to a directory object. Limiting sharing to existing guests adds a gate: someone decides who becomes a guest before anything is shared.

Impact

Users can no longer create Anyone links; existing ones stop working when the level is lowered. File requests (anonymous upload) need Anyone on OneDrive and stop working. External recipients must sign in or use a one-time passcode. With Existing guests, users cannot share with a new external address until the person is invited as a guest, which needs a guest invitation process (CB-M365-TENANT-011).

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a Global Reader.
2. Browse to Policies > Sharing. Under External sharing, read the SharePoint slider.
3. Read-only alternative: as a Global Reader, call Microsoft Graph GET https://graph.microsoft.com/v1.0/admin/sharepoint/settings (permission SharePointTenantSettings.Read.All, or Get-MgAdminSharepointSetting) and read sharingCapability. With the SharePoint Online Management Shell (SharePoint Administrator): Get-SPOTenant | Select-Object SharingCapability.
4. Optionally list sites set to a more permissive level than expected: Get-SPOSite -Limit All | Where-Object SharingCapability -eq 'ExternalUserAndGuestSharing'.
5. Fail if the level is more permissive than {{ sharepoint_sharing_level }} (order: ExternalUserAndGuestSharing > ExternalUserSharingOnly > ExistingExternalUserSharingOnly > Disabled).

Remediation

1. Find current Anyone links before cutting them: the sharing reports of each site, or the audit log (Purview > Audit, activity AnonymousLinkCreated). Tell the owners which links will stop working.
2. In the SharePoint admin center, browse to Policies > Sharing and move the SharePoint slider to the level matching {{ sharepoint_sharing_level }} (New and existing guests, Existing guests or Only people in your organization). The OneDrive slider follows if it was more permissive. Select Save. Role: SharePoint Administrator.
3. PowerShell equivalent: Set-SPOTenant -SharingCapability {{ sharepoint_sharing_level }}. Graph equivalent: PATCH /admin/sharepoint/settings with sharingCapability.

Rollback

Move the slider back to the previous level. Links that were disabled by the change work again if they have not expired.

References

• Manage sharing settings for SharePoint and OneDrive in Microsoft 365 Microsoft, vendor-doc, accessed 2026-10-24
• External sharing overview Microsoft, vendor-doc, accessed 2026-10-24
• Set-SPOTenant (SharePoint Online Management Shell) Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft SharePoint Online and OneDrive baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-COLLAB-002 Enable SharePoint and OneDrive integration with Microsoft Entra B2B
• related CB-M365-COLLAB-004 Restrict OneDrive external sharing to authenticated guests The OneDrive level can never be more permissive than the SharePoint level.
• related CB-M365-COLLAB-005 Limit SharePoint and OneDrive external sharing to approved domains
• related CB-M365-COLLAB-006 Allow only members of approved security groups to share externally
• related CB-M365-COLLAB-007 Prevent guests from resharing items they do not own
• related CB-M365-COLLAB-010 Make Anyone links expire and grant view only Applies only where Anyone links remain allowed.
• related CB-M365-COLLAB-011 Expire guest access to sites and OneDrive automatically
• related CB-M365-COLLAB-015 Limit SharePoint and OneDrive to web-only access from unmanaged devices Anyone links are not covered by unmanaged device restrictions.
• related CB-M365-TENANT-011 Restrict guest invitations to administrators and Guest Inviters
• related CB-M365-DATA-001 Enforce a DLP policy for sensitive data in Exchange, SharePoint and OneDrive

People and lifecycle