Prevent guests from resharing items they do not own

Description

Guests cannot share files, folders or sites that they do not own, even with full control or edit permission (PreventExternalUsersFromResharing = True). In the SharePoint admin center the Allow guests to share items they don't own option is cleared.

Rationale

Each guest is an identity the organization trusted for a specific purpose. Letting guests reshare extends that trust to people nobody in the organization chose, and the chain can repeat. Blocking resharing keeps every external recipient tied to an internal decision and to the sharing audit trail of an internal user.

Impact

Guests who coordinate their own team (for example a contractor adding colleagues) must ask an internal owner to share or invite. None known otherwise.

Setting

Audit

1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a Global Reader.
2. Browse to Policies > Sharing > More external sharing settings and check that Allow guests to share items they don't own is cleared.
3. Read-only alternative: as a Global Reader, call Microsoft Graph GET https://graph.microsoft.com/v1.0/admin/sharepoint/settings (permission SharePointTenantSettings.Read.All, or Get-MgAdminSharepointSetting): isResharingByExternalUsersEnabled must be false. With the SharePoint Online Management Shell (SharePoint Administrator): Get-SPOTenant | Select-Object PreventExternalUsersFromResharing must return True.
4. Fail if guests can reshare.

Remediation

1. In the SharePoint admin center, browse to Policies > Sharing > More external sharing settings, clear Allow guests to share items they don't own and Save. Role: SharePoint Administrator.
2. PowerShell equivalent: Set-SPOTenant -PreventExternalUsersFromResharing $true. Graph equivalent: PATCH /admin/sharepoint/settings with {"isResharingByExternalUsersEnabled": false}.

References

• Manage sharing settings for SharePoint and OneDrive in Microsoft 365 Microsoft, vendor-doc, accessed 2026-10-24
• Set-SPOTenant (SharePoint Online Management Shell) Microsoft, vendor-doc, accessed 2026-10-24
• sharepointSettings resource type (Microsoft Graph) Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-COLLAB-003 Restrict SharePoint external sharing to authenticated guests

People and lifecycle