Restrict OneDrive external sharing to authenticated guests

Description

The organization-level external sharing level for OneDrive is at most {{ onedrive_sharing_level }} and never more permissive than the SharePoint level (CB-M365-COLLAB-003). The baseline allows new and existing guests (no Anyone links); the hardened profile turns OneDrive external sharing off (Only people in your organization), so external collaboration happens in team sites where owners and labels govern it.

Rationale

OneDrive holds personal working copies, often the least classified and least reviewed content in the tenant. Sharing from OneDrive bypasses site owners, site-level sharing settings and team membership reviews. Anyone links from OneDrive are a common source of data leaks. Turning OneDrive external sharing off moves external collaboration to governed sites.

Impact

In the baseline, users can still share OneDrive items with authenticated guests, but Anyone links and File requests stop working. In the hardened profile, users cannot share OneDrive content externally at all; existing external shares stop working. Provide a team site or a shared channel for external projects before the change. Per-user exceptions are possible with Set-SPOSite -Identity <OneDrive URL> -SharingCapability.

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a Global Reader.
2. Browse to Policies > Sharing. Under External sharing, read the OneDrive slider.
3. With the SharePoint Online Management Shell (SharePoint Administrator): Get-SPOTenant | Select-Object OneDriveSharingCapability, SharingCapability.
4. Optionally list OneDrive sites with a more permissive level: Get-SPOSite -IncludePersonalSite $true -Limit All -Filter "Url -like '-my.sharepoint.com/personal/'" | Where-Object SharingCapability -ne 'Disabled'.
5. Fail if the OneDrive level is more permissive than {{ onedrive_sharing_level }} (order: ExternalUserAndGuestSharing > ExternalUserSharingOnly > ExistingExternalUserSharingOnly > Disabled).

Remediation

1. Identify users who share from OneDrive externally (audit log activities SharingInvitationCreated and AnonymousLinkCreated on -my.sharepoint.com URLs) and agree on where external work moves.
2. In the SharePoint admin center, browse to Policies > Sharing and move the OneDrive slider to the level matching {{ onedrive_sharing_level }}. Select Save. Role: SharePoint Administrator.
3. PowerShell equivalent: Set-SPOTenant -OneDriveSharingCapability {{ onedrive_sharing_level }}.

Rollback

Move the OneDrive slider back to the previous level, or grant a single user an exception with Set-SPOSite -Identity <OneDrive URL> -SharingCapability ExternalUserSharingOnly.

References

• Manage sharing settings for SharePoint and OneDrive in Microsoft 365 Microsoft, vendor-doc, accessed 2026-10-24
• Change the external sharing setting for a user's OneDrive Microsoft, vendor-doc, accessed 2026-10-24
• Set-SPOTenant (SharePoint Online Management Shell) Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft SharePoint Online and OneDrive baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-COLLAB-003 Restrict SharePoint external sharing to authenticated guests
• related CB-M365-COLLAB-010 Make Anyone links expire and grant view only

People and lifecycle