{
  "id": "CB-M365-COLLAB-004",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-004",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-004.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-004.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-004",
    "title": "Restrict OneDrive external sharing to authenticated guests",
    "finding": {
      "title": "OneDrive allows external sharing beyond the approved level",
      "description": "Users can share personal OneDrive content with anyone holding a link, or with any external address, outside the governance applied to team sites."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "external-sharing",
      "anonymous-links",
      "onedrive",
      "guest-access"
    ],
    "description": "The organization-level external sharing level for OneDrive is at most `{{ onedrive_sharing_level }}`\nand never more permissive than the SharePoint level (CB-M365-COLLAB-003). The baseline allows new\nand existing guests (no **Anyone** links); the hardened profile turns OneDrive external sharing off\n(**Only people in your organization**), so external collaboration happens in team sites where owners\nand labels govern it.\n",
    "rationale": "OneDrive holds personal working copies, often the least classified and least reviewed content in the\ntenant. Sharing from OneDrive bypasses site owners, site-level sharing settings and team membership\nreviews. **Anyone** links from OneDrive are a common source of data leaks. Turning OneDrive external\nsharing off moves external collaboration to governed sites.\n",
    "impact": "In the baseline, users can still share OneDrive items with authenticated guests, but **Anyone**\nlinks and **File requests** stop working. In the hardened profile, users cannot share OneDrive\ncontent externally at all; existing external shares stop working. Provide a team site or a shared\nchannel for external projects before the change. Per-user exceptions are possible with\n`Set-SPOSite -Identity <OneDrive URL> -SharingCapability`.\n",
    "setting": {
      "location": "SharePoint admin center > Policies > Sharing > External sharing > OneDrive",
      "default_value": "Anyone (ExternalUserAndGuestSharing)",
      "recommended_value": "{{ onedrive_sharing_level }} or more restrictive"
    },
    "parameters": [
      {
        "name": "onedrive_sharing_level",
        "type": "enum",
        "description": "Most permissive OneDrive external sharing level allowed (OneDriveSharingCapability value).",
        "default": "ExternalUserSharingOnly",
        "profile_defaults": {
          "hardened": "Disabled"
        },
        "allowed": [
          "ExternalUserSharingOnly",
          "ExistingExternalUserSharingOnly",
          "Disabled"
        ]
      }
    ],
    "audit": {
      "manual": "1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a\n   Global Reader.\n2. Browse to **Policies** > **Sharing**. Under **External sharing**, read the OneDrive slider.\n3. With the SharePoint Online Management Shell (SharePoint Administrator):\n   `Get-SPOTenant | Select-Object OneDriveSharingCapability, SharingCapability`.\n4. Optionally list OneDrive sites with a more permissive level:\n   `Get-SPOSite -IncludePersonalSite $true -Limit All -Filter \"Url -like '-my.sharepoint.com/personal/'\" | Where-Object SharingCapability -ne 'Disabled'`.\n5. Fail if the OneDrive level is more permissive than `{{ onedrive_sharing_level }}` (order:\n   `ExternalUserAndGuestSharing` > `ExternalUserSharingOnly` > `ExistingExternalUserSharingOnly` >\n   `Disabled`).\n"
    },
    "remediation": {
      "manual": "1. Identify users who share from OneDrive externally (audit log activities\n   `SharingInvitationCreated` and `AnonymousLinkCreated` on `-my.sharepoint.com` URLs) and agree on\n   where external work moves.\n2. In the SharePoint admin center, browse to **Policies** > **Sharing** and move the OneDrive slider\n   to the level matching `{{ onedrive_sharing_level }}`. Select **Save**. Role: SharePoint\n   Administrator.\n3. PowerShell equivalent: `Set-SPOTenant -OneDriveSharingCapability {{ onedrive_sharing_level }}`.\n",
      "rollback": "Move the OneDrive slider back to the previous level, or grant a single user an exception with\n`Set-SPOSite -Identity <OneDrive URL> -SharingCapability ExternalUserSharingOnly`.\n"
    },
    "references": [
      {
        "title": "Manage sharing settings for SharePoint and OneDrive in Microsoft 365",
        "url": "https://learn.microsoft.com/sharepoint/turn-external-sharing-on-or-off",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Change the external sharing setting for a user's OneDrive",
        "url": "https://learn.microsoft.com/onedrive/user-external-sharing-settings",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-SPOTenant (SharePoint Online Management Shell)",
        "url": "https://learn.microsoft.com/powershell/module/microsoft.online.sharepoint.powershell/set-spotenant",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft SharePoint Online and OneDrive baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/sharepoint.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.SHAREPOINT.1.2v1",
        "relation": "looser",
        "note": "SCuBA requires existing guests or organization only; the hardened profile meets it, the baseline also allows new guests."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-21",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1530"
      },
      {
        "framework": "mitre-attack",
        "id": "T1567.002"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-COLLAB-003",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-010",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}