# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-TENANT-018
title: Disable external sharing of Sway content
finding:
  title: Users can share Sways outside the organization
  description: Sways can be shared with external people or anyone with the link, outside the sharing controls applied to SharePoint and OneDrive.
status: active
profiles: [hardened]
risk:
  severity: low
assessment: manual
tags: [microsoft-365, sway, external-sharing, data-exposure]

setting:
  location: Microsoft 365 admin center > Settings > Org settings > Services > Sway > Let people in your organization share their sways with people outside your organization
  default_value: Checked
  recommended_value: Cleared

description: |
  In the Sway settings, **Let people in your organization share their sways with people outside
  your organization** is cleared. Sways can only be shared with people in the organization.
rationale: |
  Sway has its own sharing model, not governed by the SharePoint and OneDrive sharing settings,
  sensitivity labels or DLP. Its external links can expose internal content to anyone who gets the
  link. When Sway is not needed for external communication, external sharing should be off.
impact: |
  Users can no longer publish Sways for customers or the public; they use approved channels
  instead. Existing external links stop working for external viewers.
notes: |
  The setting has no PowerShell or Graph equivalent. Sway can also be turned off entirely by
  removing the Sway service plan from licenses.

audit:
  manual: |
    1. Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a
       Global Reader.
    2. Browse to **Settings** > **Org settings** > **Services** > **Sway**, section **Sharing**.
    3. Fail if **Let people in your organization share their sways with people outside your
       organization** is checked.

remediation:
  manual: |
    1. Sign in to the Microsoft 365 admin center as at least a Global Administrator (or Office
       Apps Administrator).
    2. Browse to **Settings** > **Org settings** > **Services** > **Sway**.
    3. Clear **Let people in your organization share their sways with people outside your
       organization** and **Save**.
  rollback: |
    Check the option again.

references:
  - title: Administrator settings for Sway
    url: https://support.microsoft.com/office/administrator-settings-for-sway-d298e79b-b6ab-44c6-9239-aa312f5784d4
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Disable access to Sway with Microsoft 365 PowerShell
    url: https://learn.microsoft.com/microsoft-365/enterprise/disable-access-to-sway-with-microsoft-365-powershell
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
mappings:
  - framework: cis-m365
    framework_version: "7.0.0"
    id: "1.3.8"
    relation: equivalent
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-21
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-3
    relation: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24