rules/findings/m365/sharepoint_online/policies/spo-external-content-sharing-not-restricted.json
|
{
"args": [ ], "provider": "Microsoft365", "serviceType": "SharePoint Online", "serviceName": "Microsoft 365", "displayName": "Ensure external content sharing is restricted", "description": "\r\n\t\tThe external sharing settings govern sharing for the organization overall. Each site has its own sharing setting that can be set independently, though it must be at the same or more restrictive setting as the organization. \r\n\t\tThe new and existing guests option requires people who have received invitations to sign in with their work or school account (if their organization uses Microsoft 365) or a Microsoft account, or to provide a code to verify their identity. Users can share with guests already in your organization\u0027s directory, and they can send invitations to people who will be added to the directory if they sign in. \r\n\t\tThe recommended state is New and existing guests or less permissive.\r\n ", "rationale": "Forcing guest authentication on the organization\u0027s tenant enables the implementation of controls and oversight over external file sharing. When a guest is registered with the organization, they now have an identity which can be accounted for. This identity can also have other restrictions applied to it through group membership and conditional access rules.", "impact": "When using B2B integration, Entra ID external collaboration settings, such as guest invite settings and collaboration restrictions apply.", "remediation": { "text": "", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-US/sharepoint/turn-external-sharing-on-or-off?WT.mc_id=365AdminCSH_spo" ], "compliance": [ { "name": "CIS Microsoft 365 Foundations Benchmark", "version": "6.1.0", "reference": "7.2.3", "profile": [ "E3 Level 1", "E5 Level 1" ] } ], "level": "medium", "tags": [ ], "rule": { "path": "o365_spo_tenant_admin_details", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "SharingCapability", "eq", "2" ] ] } ] } ], "shouldExist": null, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "RootSiteUrl": "Root Site", "SharingCapability": "Sharing Capability" }, "expandObject": null }, "table": null, "decorate": [ ], "emphasis": [ ], "actions": { "objectData": { "properties": [ "*" ], "expandObject": null, "limit": null }, "showGoToButton": false, "showModalButton": false, "directLink": null } }, "text": { "data": { "properties": { }, "expandObject": null }, "status": { "keyName": [ "RootSiteUrl" ], "message": "Ensure external content sharing is restricted for {RootSiteUrl}", "defaultMessage": null }, "properties": { "resourceName": "RootSiteUrl", "resourceId": "_ObjectIdentity_", "resourceType": "SPOTenantAdmin" }, "onlyStatus": false } }, "idSuffix": "spo_external_content_sharing_not_restricted", "notes": [ ], "categories": [ ], "immutable_properties": [ "_ObjectType_", "_ObjectIdentity_", "RootSiteUrl" ], "id": "microsoft365_2185" } |