Detections
Analytics
6.1 Ensure document sharing is being controlled by domains with whitelist or blacklist
Information
You should control sharing of documents to external domains by either blocking domains or only allowing sharing with specific named domains.Rationale:
Attackers will often attempt to expose sensitive information to external entities through sharing, and restricting the domains that your users can share documents with will reduce that surface area.
Impact:
Enabling this feature will prevent users from sharing documents with domains outside of the organization unless allowed.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
To configure document sharing restrictions, use the Microsoft 365 Admin Center:Navigate to Microsoft 365 administration portal (https://admin.microsoft.com), Click on Admin Centers and then SharePoint.
Expand Policies then click Sharing.
Expand More external sharing settings and check Limit external sharing by domain.
Select Add domains to add a list of approved domains
Click Save at the bottom of the page.
To configure document sharing restrictions, you can also use SharePoint Online PowerShell:
Connect to SharePoint Online using Connect-SPOService
Run the following PowerShell command:
Set-SPOTenant -SharingDomainRestrictionMode AllowList -SharingAllowedDomainList 'domain1.com domain2.com'
Default Value:
off
See Also
Item Details
Audit Name: CIS Microsoft 365 Foundations E3 L2 v1.5.0
References: CSCv7|13.4, CSCv7|14.6
Plugin: microsoft_azure
Control ID: 8b0e5e1a8f5717017d6f308db47f86e6685114d08c2e32beb97adbc0c4c60a9b