CIS.M365.7.2.5: Ensure that SharePoint guest users cannot share items they don't own

Not run by Mito today

This check needs a connection to SharePoint Online PowerShell, which Mito’s assessment does not set up. Mito reports it as skipped.

CIS Benchmark notice

This check implements a recommendation of the CIS Microsoft 365 Foundations Benchmark. The benchmark text is © Center for Internet Security, Inc. and is not reproduced here beyond the short summary below. Get the full benchmark free of charge from cisecurity.org.

ID	CIS.M365.7.2.5
Severity	Medium
Suite	CIS Microsoft 365 Foundations Benchmark
Product	SharePoint
Feature	External sharing
Security area	External access and sharing
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Benchmark	CIS Microsoft 365 Foundations Benchmark 7.0.0, 7.2.5 (L2, E3 Level 2, E5 Level 2)
Framework controls	cis-m365:7.2.5 nist-800-53-r5:AC-3 Access Enforcement nist-800-53-r5:AC-21 Information Sharing
MITRE ATT&CK	T1213.002, T1530
Reads from	SharePoint Online PowerShell

What this checks and how to fix it

7.2.5 (L2) Ensure that SharePoint guest users cannot share items they don’t own

SharePoint gives users the ability to share files, folders, and site collections. Internal users can share with external collaborators, and with the right permissions could share to other external parties.

Rationale

Sharing and collaboration are key; however, file, folder, or site collection owners should have the authority over what external users get shared with to prevent unauthorized disclosures of information.

Impact

The impact associated with this change is highly dependent upon current practices. If users do not regularly share with external parties, then minimal impact is likely. However, if users do regularly share with guests/externally, minimum impacts could occur as those external users will be unable to ‘re-share’ content.

Remediation

1. Navigate to SharePoint admin center
2. Click to expand Policies > Sharing.
3. Scroll to and expand More external sharing settings., uncheck Allow guests to share items they don’t own.
4. Click Save.

PowerShell

1. Connect to SharePoint Online using Connect-SPOService
2. Run the following command:

Set-SPOTenant -PreventExternalUsersFromResharing $True

Default Value: Checked (False)

Related Links

• Manage sharing settings for SharePoint and OneDrive in Microsoft 365
• Overview of external sharing in SharePoint and OneDrive in Microsoft 365
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 474

---

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: Mynster9361. Open-source licences.