{
  "id": "CB-M365-COLLAB-007",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-007",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-007.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-007.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-007",
    "title": "Prevent guests from resharing items they do not own",
    "finding": {
      "title": "Guests can reshare files, folders and sites they do not own",
      "description": "A guest with edit rights can pass content on to other external people without the owner or the organization deciding it."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "external-sharing",
      "guest-access",
      "sharepoint",
      "onedrive"
    ],
    "description": "Guests cannot share files, folders or sites that they do not own, even with full control or edit\npermission (`PreventExternalUsersFromResharing` = `True`). In the SharePoint admin center the\n**Allow guests to share items they don't own** option is cleared.\n",
    "rationale": "Each guest is an identity the organization trusted for a specific purpose. Letting guests reshare\nextends that trust to people nobody in the organization chose, and the chain can repeat. Blocking\nresharing keeps every external recipient tied to an internal decision and to the sharing audit trail\nof an internal user.\n",
    "impact": "Guests who coordinate their own team (for example a contractor adding colleagues) must ask an\ninternal owner to share or invite. None known otherwise.\n",
    "setting": {
      "location": "SharePoint admin center > Policies > Sharing > More external sharing settings > Allow guests to share items they don't own",
      "default_value": "Selected (guests with full control can reshare)",
      "recommended_value": "Cleared (PreventExternalUsersFromResharing = True)"
    },
    "audit": {
      "manual": "1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a\n   Global Reader.\n2. Browse to **Policies** > **Sharing** > **More external sharing settings** and check that **Allow\n   guests to share items they don't own** is cleared.\n3. Read-only alternative: as a Global Reader, call Microsoft Graph\n   `GET https://graph.microsoft.com/v1.0/admin/sharepoint/settings` (permission\n   `SharePointTenantSettings.Read.All`, or `Get-MgAdminSharepointSetting`):\n   `isResharingByExternalUsersEnabled` must be `false`. With the SharePoint Online Management Shell\n   (SharePoint Administrator): `Get-SPOTenant | Select-Object PreventExternalUsersFromResharing`\n   must return `True`.\n4. Fail if guests can reshare.\n"
    },
    "remediation": {
      "manual": "1. In the SharePoint admin center, browse to **Policies** > **Sharing** > **More external sharing\n   settings**, clear **Allow guests to share items they don't own** and **Save**. Role: SharePoint\n   Administrator.\n2. PowerShell equivalent: `Set-SPOTenant -PreventExternalUsersFromResharing $true`. Graph\n   equivalent: `PATCH /admin/sharepoint/settings` with\n   `{\"isResharingByExternalUsersEnabled\": false}`.\n"
    },
    "references": [
      {
        "title": "Manage sharing settings for SharePoint and OneDrive in Microsoft 365",
        "url": "https://learn.microsoft.com/sharepoint/turn-external-sharing-on-or-off",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-SPOTenant (SharePoint Online Management Shell)",
        "url": "https://learn.microsoft.com/powershell/module/microsoft.online.sharepoint.powershell/set-spotenant",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "sharepointSettings resource type (Microsoft Graph)",
        "url": "https://learn.microsoft.com/graph/api/resources/sharepointsettings",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-21",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1530"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-COLLAB-003",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}