Rec: 7.2.3 - Validate Test-RestrictExternalSharing.ps1, ELevel: E3, ProfileLevel: L1, IG1: TRUE, IG2: TRUE, IG3: TRUE, Connection: SPO

[DrIOSX]

Validation for Test-RestrictExternalSharing.ps1

Recommendation Details

• Recommendation: 7.2.3
• Description: Ensure external content sharing is restricted
• ELevel: E3
• Profile Level: L1
• CIS Control: 3.3
• CIS Description: Configure Data Access Control Lists
• Implementation Group 1: TRUE
• Implementation Group 2: TRUE
• Implementation Group 3: TRUE
• Automated: TRUE
• Connection: SPO

Test-RestrictExternalSharing.ps1

Tasks

Validate recommendation details

• [x] Confirm that the recommendation details are accurate and complete as per the CIS benchmark.

Validate test for a pass

• [ ] Confirm that the automated test results align with the manual audit steps outlined in the CIS benchmark.
  • Specific conditions to check:
  • Condition A: The SharingCapability is set to "ExternalUserSharingOnly" or more restrictive in the SharePoint admin center.
  • Condition B: Using PowerShell, the SharingCapability property for the SharePoint tenant is set to "ExternalUserSharingOnly", "ExistingExternalUserSharingOnly", or "Disabled".
  • Condition C: The external sharing settings in SharePoint Online and OneDrive are set to the same or a more restrictive level than the organization’s sharing settings.

Validate test for a fail

• [ ] Confirm that the failure conditions in the automated test are consistent with the manual audit results.
  • Specific conditions to check:
  • Condition A: The SharingCapability is set to "Anyone" or "ExternalUserAndGuestSharing" in the SharePoint admin center.
  • Condition B: Using PowerShell, the SharingCapability property for the SharePoint tenant is set to "Anyone" or "ExternalUserAndGuestSharing".
  • Condition C: The external sharing settings in SharePoint Online and OneDrive are set to a more permissive level than the organization’s sharing settings.

Add notes and observations

• [ ] Compare the automated audit results with the manual audit steps and provide detailed observations.
  • Automated audit produced info consistent with the manual audit test results? (Yes/No)
  • Without disclosing any sensitive information, document any discrepancies between the actual output and the expected output.
  • Document any error messages, removing any sensitive information before submitting.
  • Identify the specific function, line, or section of the script that failed, if known.
  • Provide any additional context or observations that might help in troubleshooting.

If needed, the helpers folder in .\source\helpers contains a CSV to assist with locating the test definition.

[DrIOSX]

Base PowerShell Audit:

Get-SPOTenant | fl SharingCapability