CISA.MS.SHAREPOINT.1.3 - External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs.
Overview
External sharing SHALL be restricted to approved external domains and/or users in approved security groups per interagency collaboration needs.
Rationale: By limiting sharing to domains or approved security groups used for interagency collaboration purposes, administrators help prevent sharing with unknown organizations and individuals.
Remediation action:
This policy is only applicable if the external sharing slider on the admin page is set to any value other than Only People in your organization.
- Sign in to the SharePoint admin center.
- Select Policies > Sharing.
- Expand More external sharing settings.
- Select Limit external sharing by domain.
- Select Add domains.
- Add each approved external domain users are allowed to share files with.
- Select Manage security groups
- Add each approved security group. Members of these groups will be allowed to share files externally.
- Select Save.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CISA.MS.SHAREPOINT.1.3 |
| Severity | Medium |
| Suite | CISA |
| Product | SharePoint |
| Feature | External sharing |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1048 Exfiltration Over Alternative Protocol, T1213.002 Sharepoint, T1530 Data from Cloud Storage |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.SHAREPOINT.1.3 |
| Criticality | SHALL |
| Upstream requirement | MS.SHAREPOINT.1.3v1 |
| Supports controls | cisa-scuba:MS.SHAREPOINT.1.3, nist-800-53-r5:AC-3, nist-800-53-r5:AC-6(10) |
| PowerShell test | Test-MtCisaSpoSharingAllowedDomain |
| Services | SharePointOnline |