What this check looks at
Checks that SharePoint and OneDrive external sharing is limited to an allow list of approved domains, where external sharing is on at all.
SharePoint and OneDrive can limit external sharing by domain: an allow list (only addresses at these domains can be shared with), a block list (anyone except these domains), or no limit, which is Microsoft’s default. The setting is SharingDomainRestrictionMode with SharingAllowedDomainList or SharingBlockedDomainList, under More external sharing settings in the SharePoint admin centre, and it applies to every site and every OneDrive.
The check passes when external sharing is off for the tenant, or when the mode is an allow list (even an empty one, which allows no domain at all). It fails when sharing is not limited by domain, and also when only a block list is set, because a block list still lets files go to any address that is not on it.
Without an allow list, a file or folder can be shared with any email address: a personal Gmail account, a competitor, or a look-alike domain an attacker registered (contoso-uk.com for contoso.co.uk). Mistakes happen too: autocomplete picks the wrong "James", the contract goes to someone outside the deal, and they open it after confirming their address with a one-time code.
Why it matters
Without a domain allow list, anyone can share a file with any email address, including a personal one or a look-alike domain an attacker registered. An allow list keeps external sharing to the organisations the business actually works with.
A typical case: at a 25-person accountancy practice, someone shares a client’s folder of tax returns with what they think is the client’s address, but autocomplete chose a similar personal address of someone else. The recipient can open every file. Misdirected data like this is consistently among the most common causes of breaches reported to the ICO.
The practice then has to decide within 72 hours whether to report to the ICO, tell the client, and explain to its professional indemnity insurer how it happened. An allow list would have refused the share at the moment it was made.
CIS Microsoft 365 Foundations Benchmark 7.2.6 and CISA SCuBA MS.SHAREPOINT.1.3v1 ask that external sharing is limited to approved domains. Internal sharing is unaffected, and partners on the list carry on as before.
How to fix it
Where: SharePoint admin centre → Policies → Sharing
Before you start
- Export who has been shared with externally (SharePoint admin centre → Reports, or the sharing reports per site) to build the list of partner domains.
- Agree the list with department heads; anything not on it stops working.
- Tell users what is changing and when, with a contact for problems.
Step by step
- Build the list of domains people genuinely share with. Start with the domains of guests already in the directory: in Graph PowerShell, Connect-MgGraph -Scopes User.Read.All, then Get-MgUser -Filter "userType eq 'Guest'" -All -Property Mail | ForEach-Object { ($_.Mail -split '@')[-1] } | Group-Object | Sort-Object Count -Descending. For the busiest sites, open the site, go to Settings > Site usage and run the "Shared with external users" report. Add domains department heads name, and leave out personal email providers.
- Agree the list and tell people. Agree the list with department heads: anything not on it stops working, including existing shares with other domains. Tell staff the date and how to ask for a domain to be added.
- Set the allow list in the SharePoint admin centre. In the SharePoint admin centre (https://<tenant>-admin.sharepoint.com), go to Policies > Sharing and expand More external sharing settings. Tick "Limit external sharing by domain", select Add domains, choose "Allow only specific domains", enter the domains one per line and select Save. Then select Save at the bottom of the Sharing page.
- Or set it in SharePoint Online PowerShell. Connect with SharePoint Online PowerShell as a SharePoint Administrator: Connect-SPOService -Url https://<tenant>-admin.sharepoint.com. Run Set-SPOTenant -SharingDomainRestrictionMode AllowList -SharingAllowedDomainList "partner.co.uk supplier.com", with the domains separated by spaces.
- Match the guest invitation list in Entra ID. So that guests invited from Teams or the Entra admin centre follow the same rule, go to the Microsoft Entra admin centre > Entra ID > External Identities > External collaboration settings. Under Collaboration restrictions, choose "Allow invitations only to the specified domains (most restrictive)", add the same domains and select Save.
- Keep the list current. Add domains when the business takes on a new partner, and review the list every quarter, removing organisations the business no longer works with.
- Confirm the change. Run Get-SPOTenant | Select-Object SharingDomainRestrictionMode, SharingAllowedDomainList: it should show AllowList and your domains. Try sharing a test file with an address at a domain that is not on the list: SharePoint refuses it.
With PowerShell
Connect-SPOService -Url https://<tenant>-admin.sharepoint.com Set-SPOTenant -SharingDomainRestrictionMode AllowList -SharingAllowedDomainList "partner.example supplier.example"
What users will notice
Files and sites can only be shared with addresses at the allowed domains. Existing shares with other domains stop working.
How to confirm it worked
Get-SPOTenant | Select-Object SharingDomainRestrictionMode, SharingAllowedDomainList shows AllowList and the domains; sharing with an address at another domain is refused.
Frameworks and controls
This check maps to controls in 14 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.c Stored data |
| DSPT | Standard 1: Personal confidential data |
| DORA | Art. 9(4)(c) Limiting logical access to what is required |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Data |
| SOC 2 | CC6.7 Restricting the transmission, movement and removal of information |
| NIST SP 800-171 | 3.1.20 Verify and control connections to external systems3.1.22 Control CUI posted or processed on publicly accessible systems |
| CMMC Level 2 | AC.L2-3.1.20 External ConnectionsAC.L2-3.1.22 Control Public Information |
| ISO 27001:2022 | A.5.14 Information transferA.5.15 Access control |
| CISA SCuBA | MS.SHAREPOINT.1.3v1 External sharing limited to approved domains or security groups |
| CIS M365 | 7.2.6 Ensure SharePoint external sharing is restricted |
| CIS Controls v8.1 | 3.3 Configure data access control lists (IG1) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Restrict sharing of SharePoint and OneDrive content by domain (Microsoft Learn)