CISA.MS.SHAREPOINT.1.1: External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization.

Not run by Mito today

This check needs a connection to SharePoint Online PowerShell, which Mito’s assessment does not set up. Mito reports it as skipped.

ID	CISA.MS.SHAREPOINT.1.1
Severity	Medium
Suite	CISA SCuBA baselines
Product	SharePoint
Feature	External sharing
Security area	External access and sharing
Resource type	Tenant
User impact of fixing	High
Effort to fix	Medium
Benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.SHAREPOINT.1.1 (SHALL)
Framework controls	cisa-scuba:MS.SHAREPOINT.1.1 nist-800-53-r5:AC-2 Account Management nist-800-53-r5:AC-3 Access Enforcement nist-800-53-r5:IA-8 Identification and Authentication (Non-organizational Users)
MITRE ATT&CK	T1048, T1213.002
Reads from	SharePoint Online PowerShell

What this checks and how to fix it

External sharing for SharePoint SHALL be limited to Existing guests or Only People in your organization.

Rationale: Sharing information outside the organization via SharePoint increases the risk of unauthorized access. By limiting external sharing, administrators decrease the risk of access to information.

Remediation action:

1. Sign in to the SharePoint admin center.
2. Select Policies > Sharing.
3. Adjust external sharing slider for SharePoint to Existing guests or Only people in your organization.

⚠️ WARNING: This will break existing sharing.

4. Select Save.

Related links

• CISA 1 External Sharing - MS.SHAREPOINT.1.1v1
• CISA ScubaGear Rego Reference

---

Mito check, based on CISA ScubaGear. Author: soulemike; contributors: SamErde, merill. Open-source licences.