Information
You should control sharing of documents to external domains by either blocking domains or only allowing sharing with specific named domains.
Rationale:
Attackers will often attempt to expose sensitive information to external entities through sharing, and restricting the domains that your users can share documents with will reduce that surface area.
Impact:
Enabling this feature will prevent users from sharing documents with domains outside of the organization unless allowed.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
To configure document sharing restrictions, use the Microsoft 365 Admin Center:
Navigate to Microsoft 365 administration portal (https://admin.microsoft.com), Click on Admin Centers and then SharePoint.
Expand Policies then click Sharing.
Expand More external sharing settings and check Limit external sharing by domain.
Select Add domains to add a list of approved domains
Click Save at the bottom of the page.
To configure document sharing restrictions, you can also use SharePoint Online PowerShell:
Connect to SharePoint Online using Connect-SPOService
Run the following PowerShell command:
Set-SPOTenant -SharingDomainRestrictionMode AllowList -SharingAllowedDomainList 'domain1.com domain2.com'
Default Value:
off