CIS.M365.7.2.2: Ensure SharePoint and OneDrive integration with Azure AD B2B is enabled

Not run by Mito today

This check needs a connection to SharePoint Online PowerShell, which Mito’s assessment does not set up. Mito reports it as skipped.

CIS Benchmark notice

This check implements a recommendation of the CIS Microsoft 365 Foundations Benchmark. The benchmark text is © Center for Internet Security, Inc. and is not reproduced here beyond the short summary below. Get the full benchmark free of charge from cisecurity.org.

ID	CIS.M365.7.2.2
Severity	Medium
Suite	CIS Microsoft 365 Foundations Benchmark
Product	SharePoint
Related products	Entra ID
Feature	External sharing
Security area	External access and sharing
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Benchmark	CIS Microsoft 365 Foundations Benchmark 7.0.0, 7.2.2 (L1, E3 Level 1, E5 Level 1)
Framework controls	cis-m365:7.2.2
MITRE ATT&CK	T1078.004, T1213.002
Reads from	SharePoint Online PowerShell

What this checks and how to fix it

7.2.2 (L1) Ensure SharePoint and OneDrive integration with Azure AD B2B is enabled

Entra ID B2B provides authentication and management of guests. Authentication happens via one-time passcode when they don’t already have a work or school account or a Microsoft account. Integration with SharePoint and OneDrive allows for more granular control of how guest user accounts are managed in the organization’s AAD, unifying a similar guest experience already deployed in other Microsoft 365 services such as Teams.

Note: Global Reader role currently can’t access SharePoint using PowerShell.

Rationale

External users assigned guest accounts will be subject to Entra ID access policies, such as multi-factor authentication. This provides a way to manage guest identities and control access to SharePoint and OneDrive resources. Without this integration, files can be shared without account registration, making it more challenging to audit and manage who has access to the organization’s data.

Impact

B2B collaboration is used with other Entra services so should not be new or unusual. Microsoft also has made the experience seamless when turning on integration on SharePoint sites that already have active files shared with guest users. The referenced Microsoft article on the subject has more details on this.

Remediation

1. Connect to SharePoint Online using Connect-SPOService
2. Run the following command:

Set-SPOTenant -EnableAzureADB2BIntegration $true

Default Value: False

Related Links

• Enabling the integration
• What is Microsoft Entra B2B collaboration?
• Set-SPOTenant
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 466

---

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: Mynster9361. Open-source licences.