Rules/SPO-001.external-sharing-restricted.psd1
|
@{ Id = 'SPO-001' Title = 'SharePoint external sharing does not allow anonymous links' Area = 'SharePointSettings' Severity = 'High' References = @( 'CIS Microsoft 365 Foundations Benchmark (SharePoint sharing settings)' 'https://learn.microsoft.com/sharepoint/turn-external-sharing-on-or-off' ) Rationale = 'With "Anyone" sharing, a single forwarded link exposes documents without any authentication or audit trail of who accessed them.' Remediation = 'Set tenant-level sharing to "New and existing guests" (or stricter) so every external access is tied to an authenticated, revocable identity.' Test = { param($Snapshot) $settings = $Snapshot.SharePointSettings if (-not $settings -or -not $settings.PSObject.Properties['sharingCapability']) { return New-TLRuleResult -Status Manual -Evidence 'sharingCapability not present in the snapshot.' } $labels = @{ 'disabled' = 'Only people in your organization' 'existingExternalUserSharingOnly' = 'Existing guests only' 'externalUserSharingOnly' = 'New and existing guests' 'externalUserAndGuestSharing' = 'Anyone (anonymous links)' } $value = [string]$settings.sharingCapability $label = $(if ($labels.ContainsKey($value)) { $labels[$value] } else { $value }) if ($value -eq 'externalUserAndGuestSharing') { New-TLRuleResult -Status Fail -Evidence ("Tenant sharing level: {0}." -f $label) } else { New-TLRuleResult -Status Pass -Evidence ("Tenant sharing level: {0}." -f $label) } } } |