{
  "id": "CB-M365-TENANT-018",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-018",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-018.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-TENANT-018.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-TENANT-018",
    "title": "Disable external sharing of Sway content",
    "finding": {
      "title": "Users can share Sways outside the organization",
      "description": "Sways can be shared with external people or anyone with the link, outside the sharing controls applied to SharePoint and OneDrive."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "manual",
    "tags": [
      "microsoft-365",
      "sway",
      "external-sharing",
      "data-exposure"
    ],
    "setting": {
      "location": "Microsoft 365 admin center > Settings > Org settings > Services > Sway > Let people in your organization share their sways with people outside your organization",
      "default_value": "Checked",
      "recommended_value": "Cleared"
    },
    "description": "In the Sway settings, **Let people in your organization share their sways with people outside\nyour organization** is cleared. Sways can only be shared with people in the organization.\n",
    "rationale": "Sway has its own sharing model, not governed by the SharePoint and OneDrive sharing settings,\nsensitivity labels or DLP. Its external links can expose internal content to anyone who gets the\nlink. When Sway is not needed for external communication, external sharing should be off.\n",
    "impact": "Users can no longer publish Sways for customers or the public; they use approved channels\ninstead. Existing external links stop working for external viewers.\n",
    "notes": "The setting has no PowerShell or Graph equivalent. Sway can also be turned off entirely by\nremoving the Sway service plan from licenses.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a\n   Global Reader.\n2. Browse to **Settings** > **Org settings** > **Services** > **Sway**, section **Sharing**.\n3. Fail if **Let people in your organization share their sways with people outside your\n   organization** is checked.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft 365 admin center as at least a Global Administrator (or Office\n   Apps Administrator).\n2. Browse to **Settings** > **Org settings** > **Services** > **Sway**.\n3. Clear **Let people in your organization share their sways with people outside your\n   organization** and **Save**.\n",
      "rollback": "Check the option again.\n"
    },
    "references": [
      {
        "title": "Administrator settings for Sway",
        "url": "https://support.microsoft.com/office/administrator-settings-for-sway-d298e79b-b6ab-44c6-9239-aa312f5784d4",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Disable access to Sway with Microsoft 365 PowerShell",
        "url": "https://learn.microsoft.com/microsoft-365/enterprise/disable-access-to-sway-with-microsoft-365-powershell",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-21",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}