Information
SharePoint gives users the ability to share files, folder, and site collections. Internal users can share with external collaborators, who with the right permissions, could share those to another external party.
Rationale:
Sharing and collaboration are key; however, file, folder, or site collection owners should have the authority over what external users get shared with to prevent unauthorized disclosures of information.
Impact:
Impact associated with this change is highly dependent upon current practices. If users do not regularly share with external parties, then minimal impact is likely. However, if users do regularly share with guests/externally, minimum impacts could occur as those external users will be unable to 're-share' content.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
To set SharePoint sharing settings, use the Microsoft 365 Admin Center:
Under Admin centers select SharePoint.
Expand Policies then select Sharing.
Expand More external sharing settings, uncheck Allow guests to share items they don't own.
Click Save.
To Set Prevent external users from sharing files, folders, and sites that they don't own, use the SharePoint Online PowerShell Module:
Connect to SharePoint Online service using Connect-SPOService.
Run the following SharePoint Online PowerShell command:
Set-SPOTenant -PreventExternalUsersFromResharing $True