Back to Checks
m365

Organization external sharing is set to Existing guests only, New and existing guests, or Disabled

sharepoint_external_sharing_restricted
Service: sharepointSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposedidentity-accesse3
Resource Type:NotDefined

Microsoft 365 SharePoint org-wide external sharing is evaluated to ensure it excludes anonymous 'Anyone' links and is restricted to authenticated guests via ExternalUserSharingOnly, ExistingExternalUserSharingOnly, or fully Disabled.

Prowler logoProwlerprowler-provider-m365

Risk

Anonymous or overly permissive sharing enables uncontrolled link access, eroding confidentiality and accountability. With edit links, integrity can be altered by unknown parties. Forwarded links and caching complicate revocation, increasing data exfiltration and long-lived exposure.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks sharepoint_external_sharing_restricted

Recommendation

Set org-level sharing to ExternalUserSharingOnly or stricter (ExistingExternalUserSharingOnly/Disabled). Apply least privilege with default links scoped to SpecificPeople, enforce Microsoft Entra B2B guest authentication, limit domains, require link expiration, block guest resharing, and monitor via audit logs.

Remediation

CLI

Set-SPOTenant -SharingCapability ExternalUserSharingOnly

Other

1Go to the Microsoft 365 admin center > Admin centers > SharePoint
2Navigate to Policies > Sharing
3Under External sharing for SharePoint, select New and existing guests (or a more restrictive option: Existing guests only or Only people in your organization)
4Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.sharepoint.sharepoint_client import (
    sharepoint_client,
)


class sharepoint_external_sharing_restricted(Check):
    """
    Check if Microsoft 365 SharePoint restricts external sharing at organization level.

    This check verifies that external sharing settings in SharePoint are configured to allow only "New and existing guests"
    (i.e., ExternalUserSharingOnly), which enforces authentication and limits access to external users. If a more permissive
    setting is used, legacy sharing may be allowed, increasing the risk of unauthorized data access.
    """

    def execute(self) -> List[CheckReportM365]:
        """
        Execute the SharePoint external sharing restriction check.

        Iterates over the SharePoint settings retrieved from the Microsoft 365 SharePoint client and generates a report
        indicating whether external sharing is restricted to 'New and existing guests' (ExternalUserSharingOnly).

        Returns:
            List[Check_Report_M365]: A list containing a report with the result of the check.
        """
        findings = []
        settings = sharepoint_client.settings
        if settings:
            report = CheckReportM365(
                self.metadata(),
                resource=settings if settings else {},
                resource_name="SharePoint Settings",
                resource_id="sharepointSettings",
            )
            report.status = "FAIL"
            report.status_extended = (
                "External sharing is not restricted and guests users can access."
            )

            if settings.sharingCapability in [
                "ExistingExternalUserSharingOnly",
                "ExternalUserSharingOnly",
                "Disabled",
            ]:
                report.status = "PASS"
                report.status_extended = "External sharing is restricted to external user sharing or more restrictive."

            findings.append(report)
        return findings

References