{
  "id": "CB-M365-COLLAB-003",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-003",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-003.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-003.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-003",
    "title": "Restrict SharePoint external sharing to authenticated guests",
    "finding": {
      "title": "SharePoint allows sharing links that anyone can open without signing in",
      "description": "A forwarded or leaked \"Anyone\" link exposes the content to whoever holds it, with no identity and no way to know who opened it."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "external-sharing",
      "anonymous-links",
      "sharepoint",
      "guest-access"
    ],
    "description": "The organization-level external sharing level for SharePoint is at most\n`{{ sharepoint_sharing_level }}`: **Anyone** links are not available, so every external recipient\nauthenticates as a guest.\n\nLevels, from most to least permissive: **Anyone** (`ExternalUserAndGuestSharing`), **New and\nexisting guests** (`ExternalUserSharingOnly`), **Existing guests**\n(`ExistingExternalUserSharingOnly`), **Only people in your organization** (`Disabled`). The baseline\nallows new and existing guests; the hardened profile only allows guests already in the directory, so\ninviting a new external person goes through the guest invitation process.\n\nEach site can be set more restrictive than the organization level, never more permissive.\n",
    "rationale": "An **Anyone** link is a bearer token: whoever has the URL gets the content, including after the link\nis forwarded, posted in a ticket or indexed by a mail gateway. No identity is recorded, so the\naccess cannot be audited, revoked per person or covered by Conditional Access. Requiring guests to\nauthenticate keeps every external access tied to a directory object. Limiting sharing to existing\nguests adds a gate: someone decides who becomes a guest before anything is shared.\n",
    "impact": "Users can no longer create **Anyone** links; existing ones stop working when the level is lowered.\n**File requests** (anonymous upload) need **Anyone** on OneDrive and stop working. External\nrecipients must sign in or use a one-time passcode. With **Existing guests**, users cannot share\nwith a new external address until the person is invited as a guest, which needs a guest invitation\nprocess (CB-M365-TENANT-011).\n",
    "setting": {
      "location": "SharePoint admin center > Policies > Sharing > External sharing > SharePoint",
      "default_value": "Anyone (ExternalUserAndGuestSharing)",
      "recommended_value": "{{ sharepoint_sharing_level }} or more restrictive"
    },
    "parameters": [
      {
        "name": "sharepoint_sharing_level",
        "type": "enum",
        "description": "Most permissive SharePoint external sharing level allowed (SharingCapability value).",
        "default": "ExternalUserSharingOnly",
        "profile_defaults": {
          "hardened": "ExistingExternalUserSharingOnly"
        },
        "allowed": [
          "ExternalUserSharingOnly",
          "ExistingExternalUserSharingOnly",
          "Disabled"
        ]
      }
    ],
    "audit": {
      "manual": "1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a\n   Global Reader.\n2. Browse to **Policies** > **Sharing**. Under **External sharing**, read the SharePoint slider.\n3. Read-only alternative: as a Global Reader, call Microsoft Graph\n   `GET https://graph.microsoft.com/v1.0/admin/sharepoint/settings` (permission\n   `SharePointTenantSettings.Read.All`, or `Get-MgAdminSharepointSetting`) and read\n   `sharingCapability`. With the SharePoint Online Management Shell (SharePoint Administrator):\n   `Get-SPOTenant | Select-Object SharingCapability`.\n4. Optionally list sites set to a more permissive level than expected:\n   `Get-SPOSite -Limit All | Where-Object SharingCapability -eq 'ExternalUserAndGuestSharing'`.\n5. Fail if the level is more permissive than `{{ sharepoint_sharing_level }}` (order:\n   `ExternalUserAndGuestSharing` > `ExternalUserSharingOnly` > `ExistingExternalUserSharingOnly` >\n   `Disabled`).\n"
    },
    "remediation": {
      "manual": "1. Find current **Anyone** links before cutting them: the sharing reports of each site, or the audit\n   log (**Purview** > **Audit**, activity `AnonymousLinkCreated`). Tell the owners which links will\n   stop working.\n2. In the SharePoint admin center, browse to **Policies** > **Sharing** and move the SharePoint\n   slider to the level matching `{{ sharepoint_sharing_level }}` (**New and existing guests**,\n   **Existing guests** or **Only people in your organization**). The OneDrive slider follows if it\n   was more permissive. Select **Save**. Role: SharePoint Administrator.\n3. PowerShell equivalent: `Set-SPOTenant -SharingCapability {{ sharepoint_sharing_level }}`. Graph\n   equivalent: `PATCH /admin/sharepoint/settings` with `sharingCapability`.\n",
      "rollback": "Move the slider back to the previous level. Links that were disabled by the change work again if\nthey have not expired.\n"
    },
    "references": [
      {
        "title": "Manage sharing settings for SharePoint and OneDrive in Microsoft 365",
        "url": "https://learn.microsoft.com/sharepoint/turn-external-sharing-on-or-off",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "External sharing overview",
        "url": "https://learn.microsoft.com/sharepoint/external-sharing-overview",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-SPOTenant (SharePoint Online Management Shell)",
        "url": "https://learn.microsoft.com/powershell/module/microsoft.online.sharepoint.powershell/set-spotenant",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft SharePoint Online and OneDrive baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/sharepoint.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.SHAREPOINT.1.1v1",
        "relation": "looser",
        "note": "SCuBA requires existing guests or organization only; that is our hardened value, the baseline also allows new guests."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-21",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-22",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1530"
      },
      {
        "framework": "mitre-attack",
        "id": "T1567.002"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-COLLAB-002",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-004",
        "type": "related",
        "note": "The OneDrive level can never be more permissive than the SharePoint level."
      },
      {
        "id": "CB-M365-COLLAB-005",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-006",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-007",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-010",
        "type": "related",
        "note": "Applies only where Anyone links remain allowed."
      },
      {
        "id": "CB-M365-COLLAB-011",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-015",
        "type": "related",
        "note": "Anyone links are not covered by unmanaged device restrictions."
      },
      {
        "id": "CB-M365-TENANT-011",
        "type": "related"
      },
      {
        "id": "CB-M365-DATA-001",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}