What this check looks at
Checks that a SharePoint or OneDrive sharing invitation can only be accepted by the account it was sent to.
When someone shares a SharePoint site, folder or file with a person outside the organisation, the guest receives an invitation by email. Unless SharePoint’s setting Guests must sign in using the same account to which sharing invitations are sent is on, that invitation can be redeemed by whoever opens it, signed in with any Microsoft or work account.
This check reads that SharePoint tenant setting (RequireAcceptingAccountMatchInvitedAccount). It is not applicable when external sharing is off. The check fails when the setting is off, so an invitation can be accepted by any account.
Invitations get forwarded: a supplier’s contact passes the email to a colleague, a shared mailbox receives it, or a mistyped address reaches a stranger. Without the setting, whoever accepts first becomes the guest, gets access meant for someone else, and appears in the audit log under an identity the organisation never invited.
Why it matters
Without this, an invitation forwarded by mistake, or on purpose, gives whoever opens it access as if they were the intended guest, and the audit log shows the wrong person.
A typical case: a 40-person firm of solicitors shares a client’s case folder with the client’s accountant. The accountant forwards the invitation to a personal address to read at home, and later to a colleague. Case files, including medical reports, become reachable by people the firm never vetted, and the audit log shows a guest the firm cannot match to the person it invited.
The setting is a single tick box, has no effect on invitations already accepted, and makes every future guest identity match the person actually invited.
CIS Controls v8 safeguard 3.3 (configure data access control lists), ISO 27001 A.5.14 (information transfer) and A.5.16 (identity management), the NCSC 10 Steps data security and identity guidance, the NCSC CAF identity verification and authentication outcome and NIST CSF PR.AA-05 expect access to go only to the person identified.
How to fix it
Where: SharePoint admin centre → Policies → Sharing
Before you start
- Nothing to prepare. Invitations already accepted keep working.
Step by step
- Open the sharing settings. In the SharePoint admin centre (https://<tenant>-admin.sharepoint.com), go to Policies > Sharing and expand More external sharing settings.
- Tick the matching-account setting. Tick Guests must sign in using the same account to which sharing invitations are sent and select Save. If the option is not shown on the page, set it with PowerShell as in the next step.
- Or set it with PowerShell. In the SharePoint Online Management Shell run Connect-SPOService -Url https://<tenant>-admin.sharepoint.com, then Set-SPOTenant -RequireAcceptingAccountMatchInvitedAccount $true.
- Tell people who share externally. Let staff know that a guest must open the invitation with the email address it was sent to; if a guest needs to use another address, send a new invitation to that address.
- Confirm the setting. Run Get-SPOTenant | Select-Object RequireAcceptingAccountMatchInvitedAccount and check it shows True. The finding clears at the next assessment.
With PowerShell
Set-SPOTenant -RequireAcceptingAccountMatchInvitedAccount $true
What users will notice
A forwarded sharing invitation can no longer be accepted by someone else; they need their own.
How to confirm it worked
Get-SPOTenant shows RequireAcceptingAccountMatchInvitedAccount as True.
Frameworks and controls
This check maps to controls in 11 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| DSPT | Standard 1: Personal confidential data |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Identities |
| SOC 2 | CC6.2 User registration, authorisation and removal |
| NIST SP 800-171 | 3.1.20 Verify and control connections to external systems |
| CMMC Level 2 | AC.L2-3.1.20 External Connections |
| ISO 27001:2022 | A.5.14 Information transferA.5.16 Identity management |
| CIS Controls v8.1 | 3.3 Configure data access control lists (IG1) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Data securityIdentity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Manage sharing settings (Microsoft Learn)