What this check looks at
Checks whether guests can pass on access to content that was shared with them.
When a file, folder or site is shared with a guest, SharePoint can let that guest share it on with other people, provided the guest can edit it and the site’s sharing level allows. The setting is "Allow guests to share items they don’t own" under More external sharing settings in the SharePoint admin centre (PreventExternalUsersFromResharing in PowerShell, isResharingByExternalUsersEnabled in Microsoft Graph), and Microsoft allows it by default.
The check fails when Microsoft Graph reports isResharingByExternalUsersEnabled as true, passes when it is false, and is not applicable when external sharing is off for the whole tenant. It reports not checked when the value was not returned.
With resharing on, your people decide who outside gets a file, and the guest decides everyone after that. A supplier’s project manager can add their own subcontractors, or their personal address, to a shared folder, and none of those people was chosen or approved by anyone in your organisation. Site owners rarely notice, because the extra people appear only in the item’s Manage access list.
Why it matters
Resharing puts the guest, not the organisation, in control of who sees company data. Access then spreads outside any review or audit the organisation performs.
A typical case: a construction firm shares a tender folder with a quantity surveyor at a partner firm, who reshares it with two subcontractors to get prices. One of those subcontractors is also pricing the rival bid. The firm never knew they had access, and finds out only when its pricing is undercut by a suspiciously small margin.
Where the folder holds personal data, resharing also means the organisation can no longer say who it has disclosed that data to, which UK GDPR expects it to know. Access reviews do not help, because the people a guest added never pass through the organisation’s own invitation process.
CIS Microsoft 365 Foundations Benchmark 7.2.5 asks that SharePoint guest users cannot share items they do not own. Guests keep full use of what was shared with them; they ask the owner to add anyone else.
How to fix it
Where: SharePoint admin centre → Policies → Sharing
Before you start
- Nothing needed; this only stops external people passing on what was shared with them.
Step by step
- Check the current value. Connect with SharePoint Online PowerShell as a SharePoint Administrator: Connect-SPOService -Url https://<tenant>-admin.sharepoint.com. Run Get-SPOTenant | Select-Object PreventExternalUsersFromResharing. False means guests can reshare.
- Turn off resharing in the SharePoint admin centre. In the SharePoint admin centre, go to Policies > Sharing, expand More external sharing settings, clear "Allow guests to share items they don’t own" and select Save.
- Or make the change in PowerShell. Run Set-SPOTenant -PreventExternalUsersFromResharing $true.
- Look at what guests have already reshared. Turning resharing off does not remove access guests have already given. In Exchange Online PowerShell, run Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-90) -EndDate (Get-Date) -RecordType SharePointSharingOperation -ResultSize 5000 | Where-Object { $_.UserIds -like '*#EXT#*' } to list sharing done by guests, and ask the site owners whether the people added should keep access.
- Confirm the change. Run Get-SPOTenant | Select-Object PreventExternalUsersFromResharing again: it should show True. In the SharePoint admin centre, "Allow guests to share items they don’t own" is cleared.
What users will notice
External users can no longer share items they do not own with further people.
How to confirm it worked
SharePoint admin centre, Policies, Sharing, More external sharing settings: "Allow guests to share items they don’t own" is off.
Frameworks and controls
This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.c Stored data |
| DSPT | Standard 1: Personal confidential data |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Data |
| SOC 2 | CC6.7 Restricting the transmission, movement and removal of information |
| NIST SP 800-171 | 3.1.20 Verify and control connections to external systems |
| CMMC Level 2 | AC.L2-3.1.20 External Connections |
| ISO 27001:2022 | A.5.14 Information transfer |
| CIS M365 | 7.2.5 Ensure that SharePoint guest users cannot share items they don't own |
| CIS Controls v8.1 | 3.3 Configure data access control lists (IG1) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of dutiesPR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- External sharing overview (Microsoft Learn)