CISA.MS.SHAREPOINT.1.2: External sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization.

Not run by Mito today

This check needs a connection to SharePoint Online PowerShell, which Mito’s assessment does not set up. Mito reports it as skipped.

ID	CISA.MS.SHAREPOINT.1.2
Severity	Medium
Suite	CISA SCuBA baselines
Product	SharePoint
Feature	External sharing
Security area	External access and sharing
Resource type	Tenant
User impact of fixing	High
Effort to fix	Medium
Benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.SHAREPOINT.1.2 (SHALL)
Framework controls	cisa-scuba:MS.SHAREPOINT.1.2 nist-800-53-r5:AC-2 Account Management nist-800-53-r5:AC-3 Access Enforcement nist-800-53-r5:IA-8 Identification and Authentication (Non-organizational Users)
MITRE ATT&CK	T1048, T1213.002, T1530
Reads from	SharePoint Online PowerShell

What this checks and how to fix it

External sharing for OneDrive SHALL be limited to Existing guests or Only People in your organization.

Rationale: Restricting OneDrive sharing reduces the risk of unauthorized data exposure from individual user storage. Allowing broad external sharing of OneDrive content increases the attack surface.

Remediation action:

1. Sign in to the SharePoint admin center.
2. Select Policies > Sharing.
3. Adjust external sharing slider for OneDrive to Existing guests or Only people in your organization.
4. Select Save.

Related links

• CISA 1 OneDrive Sharing - MS.SHAREPOINT.1.2v1
• CISA ScubaGear Rego Reference

---

Mito check, based on CISA ScubaGear. Author: Mynster9361. Open-source licences.