# External (Guest) Users Resharing

> This setting prevents external (guest) users from resharing content they have access to, ensuring that only authorized users can extend access to shared items.

This setting prevents external (guest) users from resharing content they have access to, ensuring that only authorized users can extend access to shared items. It helps maintain tighter control over sensitive information and reduces the risk of data leaks.

## Settings this baseline controls

| Setting                   | What it does                                                                                                                                                                                                |
| ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Guest resharing prevented | Prevents external users from resharing files, folders, and sites that they do not own. [Learn more](https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenant?view=sharepoint-ps) |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline stops guests resharing SharePoint and OneDrive content with anyone else. It
applies to the whole tenant.

1. **Add the baseline to the tenant** ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or deploy it to many
   tenants at once as part of a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. Leave **Guest resharing prevented** on. A guest who's been given access to a file, folder or
   site can't extend that access to anyone else; only people inside the organisation can
   reshare it further.
3. This setting has no admin centre toggle. Octiga writes it straight to SharePoint Online for
   you, so there's nothing in Microsoft 365 to check first.
4. Save. Turn on **Auto-remediation** and Octiga turns this back on automatically if it's switched
   off in Microsoft 365.

> **Licence: SharePoint Online:**

## Check it worked

**Passing** means SharePoint Online's guest-resharing setting reports as prevented. There's no
admin centre page for it, so use SharePoint Online PowerShell to see it directly. A guest who
could previously reshare a file with someone new no longer has that option: they can still
open what was shared with them, but sharing it onward has no effect. No one else in the tenant
notices a change.

## Standards this addresses

### CIS

- **M365 7.2.3** — CIS M365 Foundations Benchmark 7.2.3
- **M365 7.2.5** — CIS M365 Foundations Benchmark 7.2.5
- **v8 3.3** — CIS Controls v8 Safeguard 3.3

### NIST

- **PR.AC-3** — NIST CSF 2.0 PR.AC-3
- **PR.DS-5** — NIST CSF 2.0 PR.DS-5
- **AC-20** — NIST SP 800-53 AC-20

### ISO 27001

- **A.8.12** — ISO/IEC 27001:2022 Annex A.8.12
- **A.8.23** — ISO/IEC 27001:2022 Annex A.8.23

### GDPR

- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)