External (Guest) Users Resharing
This setting prevents external (guest) users from resharing content they have access to, ensuring that only authorized users can extend access to shared items. It helps maintain tighter control over sensitive information and reduces the risk of data leaks.
Settings this baseline controls
| Setting | What it does |
|---|---|
| Guest resharing prevented | Prevents external users from resharing files, folders, and sites that they do not own. Learn more |
Configure it
This baseline stops guests resharing SharePoint and OneDrive content with anyone else. It applies to the whole tenant.
-
Add the baseline to the tenant (Adding a baseline), or deploy it to many tenants at once as part of a scheme (Deploying a scheme).
-
Leave Guest resharing prevented on. A guest who’s been given access to a file, folder or site can’t extend that access to anyone else; only people inside the organisation can reshare it further.
-
This setting has no admin centre toggle. Octiga writes it straight to SharePoint Online for you, so there’s nothing in Microsoft 365 to check first.
-
Save. Turn on Auto-remediation and Octiga turns this back on automatically if it’s switched off in Microsoft 365.
Check it worked
Passing means SharePoint Online’s guest-resharing setting reports as prevented. There’s no admin centre page for it, so use SharePoint Online PowerShell to see it directly. A guest who could previously reshare a file with someone new no longer has that option: they can still open what was shared with them, but sharing it onward has no effect. No one else in the tenant notices a change.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.