SharePoint and OneDrive Sharing: What CIS Benchmark Section 7 Checks (12 Controls)

The CIS Microsoft 365 Foundations Benchmark v7.0.0 defines 160 controls across 9 sections. Section 7 — Microsoft SharePoint Online and OneDrive — contains 15 of them, and almost all of them come down to one question: who can see a file once someone inside your tenant decides to share it.

This is a different class of risk from the sections around it. Section 2 protects you from what attackers send in. Section 7 governs what your own users send out — usually with good intentions, usually to get work done, and usually with whatever sharing default the tenant happened to ship with. A permissive default here does not raise an alert. It produces a link that keeps working for anyone who has it.

For an overview of all 9 sections, see the CIS Microsoft 365 Foundations Benchmark guide.

How Section 7 is structured

The 12 controls split into two subsections:

• 7.2 — 11 controls: external sharing scope, guest access lifetime, and sharing link defaults
• 7.3 — 1 control: infected file downloads

The benchmark stores numeric recommendation IDs and their descriptions; it does not group them under names. The groupings below follow what the controls actually govern in the SharePoint admin center.

7.2 — External sharing and link defaults

The organization-wide sharing ceiling

The external sharing settings govern sharing for the organization overall. Each site has its own sharing setting that can be set independently, though it must be at the same or a more restrictive setting than the organization. That relationship is why the benchmark weights the tenant-level value so heavily: it is a ceiling, not a suggestion, and every site sits underneath it.

OneDrive has a matching setting. OneDrive content sharing can be restricted independently of SharePoint, but it can never be more permissive than the level established by SharePoint. The recommended state for OneDrive is Only people in your organization.

Two further controls narrow the same surface from different angles. One controls sharing of documents to external domains, either by blocking domains or by allowing sharing only with specific named domains. The other restricts external sharing to specific security groups; that setting is global, applies to sharing in both SharePoint and OneDrive, and cannot be set at the site level in SharePoint.

How to check: In the SharePoint admin center, open Policies → Sharing and review the external sharing levels for SharePoint and OneDrive, the domain allow and block list, and the option limiting external sharing to specific security groups.

Guest access does not expire on its own

Two controls exist because access granted once tends to persist. The guest access expiration policy configures the expiration time for each guest invited to a SharePoint site, or with whom users share individual files and folders — the recommended state is 30 days or less. Separately, guests who use a verification code to access a site or link can be required to reauthenticate after a set number of days; the recommended state there is 15 or less.

The benchmark also covers Entra ID B2B integration for SharePoint and OneDrive. B2B provides authentication and management of guests — authenticating via one-time passcode when the guest does not already have a work or school account or a Microsoft account — and integrating it allows more granular control over how guest user accounts are managed, rather than leaving them as loose site-scoped grants.

The defaults users never change

Three controls target the sharing dialog itself, on the premise that most users accept whatever is preselected.

• Default sharing link type. This sets the default link type a user will see when sharing content in OneDrive or SharePoint. It does not restrict or exclude any other option. The recommended state is Specific people (only the people the user specifies), or Only people in your organization as the more restrictive alternative.
• Default sharing link permission. This is the permission selected by default for a sharing link from a SharePoint site. The recommended state is View — so the accidental case grants read access, not write access.
• User sharing capability. SharePoint gives users the ability to share files, folders, and site collections. Internal users can share with external collaborators and, with the right permissions, could share onward to other external parties. This control governs that capability directly.

Also in this subsection is modern authentication for SharePoint, which enables authentication features such as multifactor authentication using smart cards, certificate-based authentication, and third-party SAML identity providers. Without it, identity controls configured elsewhere in the benchmark do not fully reach SharePoint.

7.3 — Site and OneDrive settings

Four controls cover behaviour that has nothing to do with sharing scope.

• Infected file downloads. By default, SharePoint Online allows files that Defender for Office 365 has detected as infected to be downloaded. The detection happens; the block does not. This control closes that gap.
• OneDrive sync restrictions. Users can sign in with their cloud tenant account and sync selected folders, or the entire contents of OneDrive, to a local computer. By default this includes any computer with OneDrive already installed — whether it is Entra joined, Entra hybrid joined, Active Directory joined, or none of those. Restricting sync to managed devices is what keeps tenant content off unmanaged endpoints.
• Custom script execution on self-service sites. Custom scripts allow users to change the look, feel, and behaviour of sites and pages, which in practice means arbitrary script running in the context of a SharePoint page. This control governs that on self-service created sites.
• Custom script execution per site. The same restriction applied to a particular site, previously called a site collection.

How to check: Infected-file download behaviour and sync restrictions live in the SharePoint admin center under Policies → Sharing and Settings; custom script settings are configured per site and via SharePoint Online PowerShell.

Why this section drifts

Section 7 is unusually prone to regression, for a structural reason: these settings are convenient to loosen and invisible once loosened. A site owner needs external sharing to close a deal. An admin raises the tenant-level setting because the site-level setting cannot exceed it. The ceiling stays raised long after the project ends. Nothing fails, nobody is notified, and the next audit finds a tenant configured for a collaboration that ended eighteen months earlier.

Guest lifetime behaves the same way. Expiration and reauthentication windows are the only mechanism that revokes access nobody remembers granting — and if they are unset, nothing revokes it.

How ConfigCobra assesses Section 7

ConfigCobra evaluates the Section 7 controls as part of a full CIS Microsoft 365 Foundations Benchmark v7.0.0 assessment. The scan connects to your tenant using read-only Microsoft Graph permissions — no agents, no admin password sharing — and returns results for all 160 controls across all 9 sections in 20–25 minutes.

For each finding you get a status against the recommended state, the evidence behind it, the CIS remediation procedure, and a copy-paste remediation script or admin portal steps where applicable. Results export to a CIS-certified PDF report with a timestamped tenant snapshot.

Because these settings drift rather than break, continuous scanning and drift detection matters more here than in most sections — you are alerted when a control that previously passed regresses, instead of discovering it at the next audit.

Run it against your own tenant

Start a free trial, 14 days with full access, to see where your SharePoint and OneDrive sharing configuration stands today.

What comes next

• Section 1 — Microsoft 365 admin center (15 controls — administrative accounts and tenant policy)
• Section 2 — Microsoft Defender for Office 365 (21 controls — Safe Links, Safe Attachments, threat policies)
• Section 6 — Exchange Online (13 controls — mailbox auditing, mail flow, Outlook add-ins)
• Section 8 — Microsoft Teams (17 controls — file sharing, external access, apps, meetings, messaging policies)

For the full benchmark overview including every section control count, see the CIS Microsoft 365 Foundations Benchmark page.