Description:
Verifies whether SharePoint is configured to allow external collaboration by default.
The check evaluates the tenant-level setting "SharePoint content can be shared with:", which is considered compliant when it is *not* set to Anyone and *not* set to Only people in your organization.
Why:
External collaboration through SharePoint can leave your organization open to security risks such as uncontrolled file sharing and sensitive data leakage.
Status detail shown in Augmentt: You have N out of M secure sharing settings applied.
This check reports a count rather than a simple pass/fail. It is Configured when every in-scope item is compliant, Partially Configured when some are, and Not Configured when none are.
Scoring: Scored proportionally — the check contributes according to how many of the in-scope items are compliant, so a partially compliant tenant earns partial credit.
Category: Data
Microsoft Licensing: Requires Premium (P1) licensing
Secure Score Impact: Not verified. No Microsoft Secure Score control could be confirmed for this setting from published sources. See the note in README.md before publishing this field.
Remediation in Augmentt: Configure directly in Augmentt (Configure tab)
Compliance Frameworks:
CISA SCuBA — MS.AAD.8.3
NIST CSF 2.0 — PR.DS-02
CIS Microsoft 365 Benchmark v6 (Level 1) — 7.2.3
CIS Microsoft 365 Benchmark v7 (Level 1) — 7.2.3
CIS Controls v8 — 3.3
CIS Controls v8.1 — 3.3
HIPAA Security Rule — 164.308(a)(4)(ii)(C)
CMMC Level 1 — AC.L1-b.1.iii, AC.L1-b.1.iv
CMMC Level 2 — AC.L2-3.1.20, AC.L2-3.1.22
Microsoft documentation:
IMPORTANT:
This check previously evaluated three settings and awarded up to 2 points with a Partially Configured tier. It now evaluates the single "SharePoint content can be shared with" setting and is scored 1 point, pass/fail. The "Guests must sign in using the same account to which sharing invitations are sent" setting was removed by Microsoft as part of the legacy guest invitation flow deprecation, and "Allow guests to share items they don't own" is now covered by the separate Resharing by External Users check.