CIS.M365.7.2.6 - (L2) Ensure SharePoint external sharing is managed through domain whitelist/blacklists
Overview
The SharePoint allow list or block list decides which external domains can receive shared content. Without a domain list, a user can share SharePoint files and sites with any external domain, including domains that the organization does not trust or that an attacker controls, which makes it an easy route for sending data out of the tenant.
Limiting external sharing to an allow list of approved domains keeps shared content with partners you have agreed to work with. Sharing with other domains is blocked until the domain is added to the list. The domain list applies to sharing with named guests, not to Anyone links, so turn off Anyone links as well (CIS 7.2.3) if content must stay with approved partners. Agree the list of partner domains with the teams that share content before you turn the restriction on.
When using Entra B2B integration, review any custom SharePoint and OneDrive domain restrictions and decide whether to move them to the Microsoft Entra B2B Allow/Deny list. This test checks the SharePoint restriction only; it does not verify the Entra list, which can also affect Teams and Microsoft 365 Groups.
Remediation action
- Sign in to the SharePoint admin center.
- Go to Policies > Sharing.
- Expand More external sharing settings.
- Select Limit external sharing by domain, then select Allow only specific domains.
- Add the approved domains and select Save.
To apply the setting with PowerShell, connect with Connect-PnPOnline -Url https://<tenant>-admin.sharepoint.com -Interactive and run the following, replacing the example domains with your approved domains:
Set-PnPTenant -SharingDomainRestrictionMode AllowList -SharingAllowedDomainList 'partner.example.com contoso.example.org'
Related links
- SharePoint admin center
- Restrict sharing of SharePoint and OneDrive content by domain
- Microsoft Entra B2B integration for SharePoint and OneDrive
- Set-PnPTenant
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 7.2.6
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.7.2.6 |
| Severity | Medium |
| Suite | CIS |
| Product | SharePoint |
| Feature | External sharing |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1213.002 Sharepoint, T1530 Data from Cloud Storage, T1537 Transfer Data to Cloud Account |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 7.2.6 |
| Benchmark level | L2 |
| Benchmark profiles | E3 Level 2 |
| Supports controls | cis-m365:7.2.6, nist-800-53-r5:AC-21 |
| PowerShell test | Test-MtCisSpoSharingDomainList |
| Services | SharePointOnline |
Source
- Test:
tests/cis/Test.CIS.M365.7.2.6.ps1 - Documentation:
tests/cis/Test.CIS.M365.7.2.6.md