{
  "id": "CB-M365-COLLAB-005",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-005",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-005.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-005.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-005",
    "title": "Limit SharePoint and OneDrive external sharing to approved domains",
    "finding": {
      "title": "External sharing is allowed with any email domain",
      "description": "Users can share files and sites with addresses at any organization, including personal mailboxes and look-alike domains."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "external-sharing",
      "domain-allowlist",
      "sharepoint",
      "onedrive"
    ],
    "description": "SharePoint and OneDrive external sharing is limited to an allow list of partner domains\n(`SharingDomainRestrictionMode` = `AllowList`, `SharingAllowedDomainList` =\n`{{ allowed_sharing_domains }}`). Sharing with an address at any other domain is refused. The\norganization-level list applies to every site and every OneDrive.\n\nIf external sharing is turned off for the whole organization, the control is met without a list.\n",
    "rationale": "An allow list turns external sharing from \"anyone with an email address\" into \"the partners we work\nwith\". It blocks sharing to personal mailboxes and to typo-squatted partner domains used in\nexfiltration and social engineering, and it makes each new partner a deliberate decision.\n",
    "impact": "Users cannot share with a new partner until an administrator adds the domain; plan a request and\napproval process. Subdomains must be listed separately. When Entra B2B integration is on\n(CB-M365-COLLAB-002), the Entra B2B allow or deny list also applies; the more restrictive of the two\nwins, so keep both consistent or manage the list in Entra (CB-M365-TENANT-012).\n",
    "setting": {
      "location": "SharePoint admin center > Policies > Sharing > More external sharing settings > Limit external sharing by domain",
      "default_value": "Off (SharingDomainRestrictionMode = None)",
      "recommended_value": "Allow only these domains: {{ allowed_sharing_domains }}"
    },
    "parameters": [
      {
        "name": "allowed_sharing_domains",
        "type": "list",
        "description": "Partner email domains that users may share with (maximum 5,000).",
        "default": []
      }
    ],
    "audit": {
      "manual": "1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a\n   Global Reader.\n2. Browse to **Policies** > **Sharing** and expand **More external sharing settings**.\n3. Check that **Limit external sharing by domain** is selected with **Allow only specific domains**,\n   and compare the list with `{{ allowed_sharing_domains }}`.\n4. Read-only alternative: as a Global Reader, call Microsoft Graph\n   `GET https://graph.microsoft.com/v1.0/admin/sharepoint/settings` (permission\n   `SharePointTenantSettings.Read.All`, or `Get-MgAdminSharepointSetting`):\n   `sharingDomainRestrictionMode` must be `allowList` and `sharingAllowedDomainList` must contain\n   only approved domains. With the SharePoint Online Management Shell (SharePoint Administrator):\n   `Get-SPOTenant | Select-Object SharingDomainRestrictionMode, SharingAllowedDomainList`.\n5. Fail if external sharing is allowed (`sharingCapability` not `disabled`) and the mode is not\n   `allowList`, or if the list contains a domain that is not approved.\n"
    },
    "remediation": {
      "manual": "1. Build the list from current external sharing: audit log activities `SharingInvitationCreated` and\n   `AddedToSecureLink`, grouped by target domain. Have the business owners approve each domain.\n2. In the SharePoint admin center, browse to **Policies** > **Sharing** > **More external sharing\n   settings**, select **Limit external sharing by domain**, choose **Allow only specific domains**,\n   add each domain and **Save**. Role: SharePoint Administrator.\n3. PowerShell equivalent:\n   `Set-SPOTenant -SharingDomainRestrictionMode AllowList -SharingAllowedDomainList \"partner1.example partner2.example\"`\n   (space-separated).\n4. Align the Microsoft Entra B2B collaboration restrictions (**Entra ID** > **External Identities**\n   > **External collaboration settings**) with the same list.\n",
      "rollback": "Run `Set-SPOTenant -SharingDomainRestrictionMode None`, or add the missing domain to the list.\n"
    },
    "references": [
      {
        "title": "Restrict sharing of SharePoint and OneDrive content by domain",
        "url": "https://learn.microsoft.com/sharepoint/restricted-domains-sharing",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Manage sharing settings for SharePoint and OneDrive in Microsoft 365",
        "url": "https://learn.microsoft.com/sharepoint/turn-external-sharing-on-or-off",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-SPOTenant (SharePoint Online Management Shell)",
        "url": "https://learn.microsoft.com/powershell/module/microsoft.online.sharepoint.powershell/set-spotenant",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft SharePoint Online and OneDrive baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/sharepoint.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.SHAREPOINT.1.3v1",
        "relation": "partial",
        "note": "SCuBA accepts approved domains or approved security groups; this control covers the domains, CB-M365-COLLAB-006 the groups."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-21",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-4",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1567.002"
      },
      {
        "framework": "mitre-attack",
        "id": "T1530"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-COLLAB-002",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-003",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-006",
        "type": "related",
        "note": "Domain and group restrictions combine; SCuBA accepts either."
      },
      {
        "id": "CB-M365-TENANT-012",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}