Limit SharePoint and OneDrive external sharing to approved domains

Description

SharePoint and OneDrive external sharing is limited to an allow list of partner domains (SharingDomainRestrictionMode = AllowList, SharingAllowedDomainList = {{ allowed_sharing_domains }}). Sharing with an address at any other domain is refused. The organization-level list applies to every site and every OneDrive.

If external sharing is turned off for the whole organization, the control is met without a list.

Rationale

An allow list turns external sharing from "anyone with an email address" into "the partners we work with". It blocks sharing to personal mailboxes and to typo-squatted partner domains used in exfiltration and social engineering, and it makes each new partner a deliberate decision.

Impact

Users cannot share with a new partner until an administrator adds the domain; plan a request and approval process. Subdomains must be listed separately. When Entra B2B integration is on (CB-M365-COLLAB-002), the Entra B2B allow or deny list also applies; the more restrictive of the two wins, so keep both consistent or manage the list in Entra (CB-M365-TENANT-012).

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a Global Reader.
2. Browse to Policies > Sharing and expand More external sharing settings.
3. Check that Limit external sharing by domain is selected with Allow only specific domains, and compare the list with {{ allowed_sharing_domains }}.
4. Read-only alternative: as a Global Reader, call Microsoft Graph GET https://graph.microsoft.com/v1.0/admin/sharepoint/settings (permission SharePointTenantSettings.Read.All, or Get-MgAdminSharepointSetting): sharingDomainRestrictionMode must be allowList and sharingAllowedDomainList must contain only approved domains. With the SharePoint Online Management Shell (SharePoint Administrator): Get-SPOTenant | Select-Object SharingDomainRestrictionMode, SharingAllowedDomainList.
5. Fail if external sharing is allowed (sharingCapability not disabled) and the mode is not allowList, or if the list contains a domain that is not approved.

Remediation

1. Build the list from current external sharing: audit log activities SharingInvitationCreated and AddedToSecureLink, grouped by target domain. Have the business owners approve each domain.
2. In the SharePoint admin center, browse to Policies > Sharing > More external sharing settings, select Limit external sharing by domain, choose Allow only specific domains, add each domain and Save. Role: SharePoint Administrator.
3. PowerShell equivalent: Set-SPOTenant -SharingDomainRestrictionMode AllowList -SharingAllowedDomainList "partner1.example partner2.example" (space-separated).
4. Align the Microsoft Entra B2B collaboration restrictions (Entra ID > External Identities

   External collaboration settings) with the same list.

Rollback

Run Set-SPOTenant -SharingDomainRestrictionMode None, or add the missing domain to the list.

References

• Restrict sharing of SharePoint and OneDrive content by domain Microsoft, vendor-doc, accessed 2026-10-24
• Manage sharing settings for SharePoint and OneDrive in Microsoft 365 Microsoft, vendor-doc, accessed 2026-10-24
• Set-SPOTenant (SharePoint Online Management Shell) Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft SharePoint Online and OneDrive baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-COLLAB-002 Enable SharePoint and OneDrive integration with Microsoft Entra B2B
• related CB-M365-COLLAB-003 Restrict SharePoint external sharing to authenticated guests
• related CB-M365-COLLAB-006 Allow only members of approved security groups to share externally Domain and group restrictions combine; SCuBA accepts either.
• related CB-M365-TENANT-012 Allow guest invitations only to approved domains

People and lifecycle