External Sharing SHOULD be Set to “New and Existing Guests”
PreviousFile and Folder Links Default Sharing Settings SHALL Be Set to Specific PeopleNextSensitive SharePoint Sites SHOULD Adjust Their Default Sharing Settings
Last updated
Last updated
SharePoint allows sharing with users who are outside the agency, which is convenient but may pose a data loss or other information security risk. This working group recommends allowlisting by domains and security groups per interagency collaboration needs. Note: Adjusting this setting will adjust external sharing for OneDrive and Teams to the same, selected level. OneDrive and Teams can be less permissive (not more permissive) than SharePoint Online. Adding approved domains and/or security groups will also be reflected in One Drive external sharing settings.
External sharing SHOULD be limited to approved domains and security groups per interagency collaboration needs.
Any tenant with SharePoint online licensing can access this setting.
To adjust sharing settings, in the SharePoint admin center:
Select Policies -> Sharing.
Adjust external sharing slider to New and Existing Guests.
Expand More external sharing settings.
Select Limit external sharing by domain.
Select Add domains.
Add domains.
Select Save.
Select Allow only users in specific security groups to share externally.
Select Manage security groups.
Add security groups.
Select Save.
With this setting enabled, users will not be able to share external links unless:
External users are added as guest to the organization
External user domains are added to the SharePoint setting
Users are added to the specified security groups so they can send to external users
