Skip to content

Control 2.12: External Sharing and Guest Access Governance

Control ID: 2.12 Pillar: Security & Protection Regulatory Reference: GLBA §501(b), SEC Reg S-P Last Verified: 2026-08-10 Governance Levels: Baseline / Recommended / Regulated

Objective

Govern external sharing and guest access settings across Microsoft 365 so external users receive access only to approved content, including sites and files that may also be in scope for internal users' Copilot grounding. SharePoint and OneDrive guest-access expiration applies only to eligible sharing-link access and direct site permissions granted after the policy is enabled. It does not alter or delete the guest's Microsoft Entra B2B account, and access through Microsoft 365 groups, security groups, or Teams can remain and must be reconciled separately. This control supports compliance with GLBA customer information safeguards and SEC Reg S-P privacy requirements.

Why This Matters for FSI

  • GLBA §501(b) requires safeguards to protect customer information from unauthorized disclosure — external sharing configurations determine whether guests, contractors, or third parties can access customer data
  • SEC Reg S-P (Rule 248.30) requires financial institutions to protect customer nonpublic personal information (NPI) — guest access to Copilot-accessible content must be governed to prevent NPI disclosure
  • SEC Reg S-P (Rule 248.14-15) provides customers with opt-out rights for certain information sharing — external sharing policies must honor applicable privacy choices
  • FINRA Rule 3110 (Supervision) requires supervision of external communications — Copilot-generated content shared with external parties requires supervisory oversight
  • OCC Bulletin 2023-17 (Third-Party Relationships): Expects controls over third-party access to customer information — guest access to M365 represents third-party access that must be governed
  • State privacy laws may restrict sharing of consumer financial information with third parties

Control Description

External sharing in Microsoft 365 determines how content can be shared with people outside the organization. These settings directly affect Copilot because:

  1. External users can access sites, files, and collaboration spaces shared with them, subject to the configured permissions
  2. Internal users' Copilot responses may include content they can access even when that content is also shared externally
  3. Copilot Pages and Loop components can potentially be shared externally

Microsoft's primary documentation cited for this control does not establish Microsoft 365 Copilot licensing eligibility for B2B guest accounts. Accordingly, this control does not use guest Copilot licensing as an enforcement mechanism; organizations evaluating that scenario should verify current Microsoft product eligibility and licensing terms separately.

External Sharing Impact on Copilot

                External Sharing Configuration
                         │
            ┌────────────┴────────────┐
            │                         │
    External-User               Internal-User
    Content Access              Copilot Grounding
            │                         │
     ┌──────┴──────┐          ┌──────┴──────┐
     │             │          │             │
  Approved      Blocked     Permitted     Removed or
  sharing       sharing     content may   restricted
     │             │        be grounded    content
     │             │          │             │
  Guest can    Guest cannot Internal user Reduced
  access the   access the   permissions   grounding
  resource     resource     still govern  scope

Sharing Levels in SharePoint/OneDrive

Sharing Level Description Copilot Impact FSI Recommendation
Disabled No external sharing Content is unavailable to external users Use for highest-sensitivity sites
Existing guests only Only guests already in directory Limited, controlled guest population Recommended minimum for most FSI sites
New and existing guests Guests can be invited and added Expands the external-user population with content access Use only where business need is documented
Anyone Anonymous access via link Permits direct anonymous access to shared content Never appropriate for FSI — disable org-wide

Guest Access Governance Framework

Governance Area Control Configuration
Guest invitation Who can invite guests Restrict to admins and guest inviter role
Guest site access Which sites guests can access Site-level sharing settings
Guest access review Periodic review of guest permissions Entra ID Access Reviews
SharePoint/OneDrive guest-access expiration When eligible direct or sharing-link access granted after enablement expires SharePoint external sharing settings
Group- and Teams-derived access Access paths that can survive SharePoint guest expiration Reconcile Microsoft 365 group, security group, and Teams membership separately
Guest account lifecycle action Optional tenant-wide block or deletion of a B2B account Separate dedicated guest-lifecycle review after all access paths and active engagements are verified obsolete
Guest MFA MFA requirement for guest access Conditional Access policies
B2B collaboration Cross-tenant access settings Entra ID Cross-Tenant Access

External Sharing Configuration Matrix for FSI

Content Type Sharing Setting External Access Justification
Client data sites Disabled No Customer NPI must not be accessible to guests
Regulatory/compliance sites Disabled No Examination and regulatory content is internal only
M&A deal rooms Existing guests only Approved guests Deal counterparties may need limited access
Vendor collaboration sites Existing guests only Approved guests Vendor access to specific project content
Marketing/public content New and existing guests Approved guests External collaboration on public materials
Intranet sites Disabled No Internal communications only
Executive sites Disabled No Strategic content is internal only

Copilot Surface Coverage

M365 Surface or Content External Sharing Relevance Copilot Governance Relevance Notes
Microsoft 365 Copilot Chat Indirect Yes Govern the underlying content permissions used for internal grounding; no B2B guest Copilot eligibility claim is made here
Word, Excel, PowerPoint, OneNote Yes Yes Files shared from SharePoint or OneDrive remain governed by sharing permissions
Outlook Separate Yes Email sharing and recipient controls are separate from SharePoint external sharing
Teams Yes Yes Guest and shared-channel access can expose connected SharePoint content
Loop and Copilot Pages Yes Yes External sharing follows the applicable Loop workspace or component permissions
SharePoint and OneDrive Yes Yes Primary scope for site, file, link, and guest-access expiration settings

Governance Levels

Level Requirement Rationale
Baseline Set org-wide external sharing to "Existing guests only" maximum; disable "Anyone" links org-wide; disable external sharing for sites containing customer data; restrict guest invitations to admins; quarterly guest access review Restricts the external sharing surface — prevents uncontrolled guest access to Copilot-accessible content
Recommended All Baseline requirements plus: implement Entra ID Access Reviews for guest access (quarterly); configure cross-tenant access policies for B2B collaboration; require business justification for site-level sharing overrides; configure SharePoint/OneDrive guest-access expiration (90 days, renewable); separately reconcile access through Microsoft 365 groups, security groups, and Teams; require guest MFA via Conditional Access; produce a monthly external sharing audit report; apply DLP policies to externally shared content Comprehensive external sharing governance with lifecycle management — suitable for firms that need external collaboration capabilities
Regulated All Recommended requirements plus: require compliance approval for external sharing; log and monitor all guest access; conduct resource access reviews monthly; disable external access by default (opt-in per site with documented approval); require a separate dedicated guest-lifecycle review before any tenant-wide account action; include guest access in annual audits and regulatory examination packages Maximum restriction on external sharing — designed for firms where external access to Copilot-accessible content is unacceptable without explicit approval

Setup & Configuration

Step 1: Configure Org-Wide Sharing Settings

Portal: SharePoint admin center > Policies > Sharing

# Connect to SharePoint Online
Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

# Set org-wide external sharing level
Set-SPOTenant -SharingCapability ExistingExternalUserSharingOnly

# Set Anyone link expiration (0 = no expiration; set to 30 for FSI). The preceding SharingCapability line controls whether Anyone links are available.
Set-SPOTenant -RequireAnonymousLinksExpireInDays 0

# Set default sharing link type to "Specific people"
Set-SPOTenant -DefaultSharingLinkType Direct

# Limit external sharing by domain (allow list is space-delimited).
# Guest invitation permissions are configured separately in Entra ID — see Step 3.
Set-SPOTenant -SharingDomainRestrictionMode AllowList `
  -SharingAllowedDomainList "partner1.com partner2.com"

Step 2: Configure Site-Level Sharing Overrides

# Disable external sharing for sensitive sites
Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/ClientData" `
  -SharingCapability Disabled

Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/Compliance" `
  -SharingCapability Disabled

Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/Executive" `
  -SharingCapability Disabled

# Allow limited sharing for collaboration sites
Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/VendorProject" `
  -SharingCapability ExistingExternalUserSharingOnly

Step 3: Configure Guest Invitation Restrictions

Portal: Microsoft Entra Admin Center > Entra ID > External Identities > External collaboration settings

  1. Set "Guest invite restrictions" to "Only users assigned to specific admin roles can invite guest users"
  2. Configure collaboration restrictions to allow specific domains only
  3. Verify email one-time passcode authentication for guests under Entra ID > External Identities > All identity providers > Email one-time passcode. This feature is turned on by default for new tenants and for existing tenants where it was not explicitly turned off.

Step 4: Configure Entra ID Access Reviews

Portal: Microsoft Entra Admin Center > Identity Governance > Access reviews

  1. Select the resource scope that matches the access being reviewed: a selected Team or group, or an application. The recurring "All Microsoft 365 groups with guest users" mode can review and remove group access, but it cannot delete guest accounts from the tenant.
  2. Frequency: Quarterly (Recommended) or Monthly (Regulated)
  3. Reviewers: Site owners or designated business sponsors
  4. Auto-apply results: For every Team, group, application, or other resource-scoped review, configure denial to remove only the reviewed resource's membership or access. Configure no account-level denied-guest action: no sign-in block and no guest-account deletion from a resource review.
  5. If tenant-wide B2B guest-account blocking or deletion is required, conduct a separate, dedicated guest-lifecycle review. Before taking an account-level action, verify that all direct permissions, sharing links, Microsoft 365 group and security group memberships, Teams and SharePoint access, application assignments, and other active engagements are obsolete, and follow the tenant's approval and lifecycle procedures.

Step 5: Configure SharePoint and OneDrive Guest-Access Expiration

Portal: SharePoint admin center > Policies > Sharing > More external sharing settings

  1. Set "Guest access to a site or OneDrive will expire automatically after this many days" (90 days recommended; the setting accepts 30 to 730 days)
  2. Document who reviews expiration notifications and who may extend approved access
  3. Verify site-level overrides for sites with different business requirements
  4. Inventory pre-existing direct or sharing-link access and access through Microsoft 365 groups, security groups, or Teams; those paths are outside the expiration policy and require separate reconciliation
# Configure 90-day expiration for eligible direct and sharing-link access
Set-SPOTenant -ExternalUserExpirationRequired $true -ExternalUserExpireInDays 90

Site-level values can override the organization-level setting under SharePoint admin center > Active sites > (site) > Settings > More sharing settings. Microsoft's guest-expiration guidance limits the policy to guests using sharing links or direct site permissions granted after the policy is enabled. It does not alter or delete the Microsoft Entra guest account. Microsoft's SharePoint sharing guidance also notes that Microsoft 365 group and Teams guest-sharing settings affect connected sites. Pre-existing access and access inherited through Microsoft 365 groups, security groups, or Teams can therefore remain and must be separately inventoried and reconciled. Optional tenant-account blocking or deletion belongs to the separate guest-lifecycle review described in Step 4, not to a resource-review denial.

Step 6: Audit Guest Identities

Inventory guest identities and reconcile them to approved external engagements. Do not infer resource access from the existence of a guest account or from a SharePoint expiration event; validate direct permissions, sharing links, Microsoft 365 groups, security groups, applications, and Teams access separately.

# Inventory guest accounts for reconciliation with approved access
Get-MgUser -Filter "userType eq 'Guest'" -All `
  -Property Id,DisplayName,UserPrincipalName,AccountEnabled,CreatedDateTime |
  Select-Object Id,DisplayName,UserPrincipalName,AccountEnabled,CreatedDateTime

Financial Sector Considerations

  • Client Data Protection: Customer NPI must not be accessible to unauthorized guest users. Sites containing client data should have external sharing disabled entirely, not merely restricted, unless a documented business and compliance approval supports a narrower exception.
  • Vendor Access Management: Financial firms frequently collaborate with external vendors (auditors, consultants, technology providers). Vendor access should be scoped to specific project sites with external sharing enabled only for those sites and reviewed against the active engagement.
  • M&A Transaction Access: During M&A transactions, deal counterparties may need access to data rooms. These sites should have external sharing configured to "Existing guests only" with specific named guests, and must be excluded from Copilot grounding scope (see Control 2.5).
  • Regulatory Examination Access: Regulators (FINRA, SEC, OCC, state regulators) may request access to firm systems during examinations. Provide examination access through controlled, temporary guest accounts with explicit, least-privilege site access.
  • B2B Collaboration with Other Financial Institutions: Cross-institutional collaboration (e.g., syndicated lending, joint ventures) requires careful sharing governance. Use Entra ID cross-tenant access policies to control B2B collaboration boundaries.
  • Guest Access Audit Trail: Maintain comprehensive logs of guest account creation, access patterns, and account removal. This audit trail supports GLBA safeguard monitoring and provides examination evidence.
  • Annual Sharing Policy Review: Review the organization's external sharing policy annually in the context of Copilot capabilities. As Copilot features expand, the risk profile of external sharing may change.

Verification Criteria

  1. Org-Wide Sharing Level: Verify the org-wide external sharing level is set to "Existing guests only" or more restrictive
  2. Anonymous Links Disabled: Confirm "Anyone" links are disabled org-wide
  3. Sensitive Site Sharing: Verify that sites containing client data, regulatory content, and executive materials have sharing set to "Disabled"
  4. Guest Invitation Restriction: Attempt to invite a guest as a standard user — verify the invitation is blocked
  5. Access Reviews Active: Confirm Entra ID Access Reviews for guest access are configured and running on schedule
  6. SharePoint/OneDrive Guest-Access Expiration: Verify eligible direct and sharing-link access granted after enablement expires as configured; separately reconcile pre-existing access and access through Microsoft 365 groups, security groups, or Teams, and do not misstate expiration as complete access removal or guest-account deletion
  7. Guest Account Lifecycle Action (If Required): Confirm a separate dedicated guest-lifecycle review verifies all direct, group, Teams, SharePoint, application, and other engagements are obsolete and obtains required approvals before any tenant-wide block or deletion; do not treat a resource-review denial as that decision
  8. Domain Restrictions: Verify that allowed domain lists are configured and only approved domains can receive sharing invitations
  9. Audit Logging: Confirm external sharing events appear in the Unified Audit Log and are monitored
  10. Policy Documentation: Verify that external sharing policies are documented, approved by compliance, and reviewed annually

Additional Resources