CIS.M365.7.2.2 - (L1) Ensure SharePoint and OneDrive integration with Azure AD B2B is enabled
Overview
7.2.2 (L1) Ensure SharePoint and OneDrive integration with Azure AD B2B is enabled
Entra ID B2B provides authentication and management of guests. Authentication happens via one-time passcode when they don't already have a work or school account or a Microsoft account. Integration with SharePoint and OneDrive allows for more granular control of how guest user accounts are managed in the organization's AAD, unifying a similar guest experience already deployed in other Microsoft 365 services such as Teams.
Current service behavior: Microsoft enabled Entra B2B integration for new external sharing in commercial tenants between May and July 2026. In these tenants, EnableAzureADB2BIntegration no longer controls the integration, and the integration cannot be disabled. This test checks that property for CIS compliance, so a False value may not reflect actual B2B behavior in an affected commercial tenant. The property remains relevant only where Microsoft says it still controls integration.
Note: Global Reader role currently can't access SharePoint using PowerShell.
Rationale
External users assigned guest accounts will be subject to Entra ID access policies, such as multi-factor authentication. This provides a way to manage guest identities and control access to SharePoint and OneDrive resources. Without this integration, files can be shared without account registration, making it more challenging to audit and manage who has access to the organization's data.
Impact
B2B collaboration is used with other Entra services so should not be new or unusual. Microsoft also has made the experience seamless when turning on integration on SharePoint sites that already have active files shared with guest users. The referenced Microsoft article on the subject has more details on this.
Remediation
- Connect to SharePoint Online using
Connect-SPOService - In tenants where this property still controls integration, run:
Set-SPOTenant -EnableAzureADB2BIntegration $true
Default Value: False. In commercial tenants where Microsoft enabled the integration, this property no longer determines the behavior for new external sharing.
Related Links
- Enabling the integration
- What is Microsoft Entra B2B collaboration?
- Set-SPOTenant
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 466
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.7.2.2 |
| Severity | Medium |
| Suite | CIS |
| Product | SharePoint |
| Related products | Entra ID |
| Feature | External sharing |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts, T1213.002 Sharepoint |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 7.2.2 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1, E5 Level 1 |
| Supports controls | cis-m365:7.2.2 |
| PowerShell test | Test-MtCisSpoB2BIntegration |
| Services | SharePointOnline |
Source
- Test:
tests/cis/Test.CIS.M365.7.2.2.ps1 - Documentation:
tests/cis/Test.CIS.M365.7.2.2.md