ReferenceCheck catalog
SharePoint Online
All 13 SharePoint Online checks - what each one checks, why, and the access used to evaluate it.
13 checks. Column "Access used" lists the application permissions and collected data sources this check's evaluation reads; "None" means Watchtower reads no tenant data for it.
| Check | Severity | What it checks | Why it matters | Access used |
|---|---|---|---|---|
SharePoint and OneDrive integration with Entra ID B2B is enabledwt.spo.aad-b2b-integration-enabled | MEDIUM | Checks that SharePoint and OneDrive are configured to use Entra ID B2B for external sharing, ensuring guest users are managed as Entra ID B2B guests rather than ad-hoc one-time passcode recipients. | When Entra ID B2B integration is disabled, external users may authenticate with one-time passcodes that bypass Entra Conditional Access and MFA policies. B2B integration ensures external users are subject to the same identity governance, Conditional Access, and access review controls as other guest accounts in the tenant. | SharePointTenantSettings.Read.All, Sites.FullControl.All - via spoTenant |
SharePoint default sharing link permission is set to Viewwt.spo.default-sharing-link-view-only | MEDIUM | Checks that the default permission on new SharePoint sharing links is View (read-only) rather than Edit, reducing the risk of unintentional write access when sharing content. | When sharing links default to Edit permissions, users who casually share a link with a colleague may inadvertently grant the recipient the ability to modify or delete content. By defaulting to View, accidental over-sharing grants read access at most, limiting the blast radius of misdelivered links and social-engineering attacks. | SharePointTenantSettings.Read.All, Sites.FullControl.All - via spoTenant |
SharePoint external sharing is restricted to allowed domainswt.spo.external-sharing-allowed-domains | MEDIUM | Checks that SharePoint external sharing is restricted to an allow-list of approved domains, preventing users from sharing content with arbitrary external email addresses. | Without domain restrictions, any user can share SharePoint content with anyone on the internet, including personal email accounts and attacker-controlled domains. Domain allow-listing ensures content can only be shared with vetted partner organisations, preventing uncontrolled data exfiltration through oversharing. | SharePointTenantSettings.Read.All, Sites.FullControl.All - via spoTenant |
External content sharing is restrictedwt.spo.external-sharing-restricted | HIGH | Checks that the SharePoint external sharing capability is set to a restrictive level - disabled (0), existing-guests-only (1), or new-and-existing-guests (3) - rather than allowing anonymous sharing to anyone. | Anonymous sharing links in SharePoint allow files and folders to be accessed by anyone with the URL, without requiring authentication. These links can be shared accidentally or maliciously, enabling data exfiltration by external parties, including competitors and threat actors who obtain the link through phishing or reconnaissance. | SharePointTenantSettings.Read.All, Sites.FullControl.All - via spoTenant |
External sharing is restricted by security groupwt.spo.external-sharing-security-group | MEDIUM | Checks that external sharing in SharePoint is limited to users who are members of a designated security group, preventing all other users from sharing content externally. | Limiting external sharing to an approved security group ensures that only users with a verified business need and appropriate training can share content externally. This reduces the risk of inadvertent data exposure by users who are unaware of external sharing risks. | None - no tenant data read (not automatable via API, reported as a manual/indeterminate result) |
Guest access to a site or OneDrive will expire automaticallywt.spo.guest-access-expiry-enabled | MEDIUM | Checks that external user access to SharePoint sites and OneDrive expires automatically within 30 days, ensuring guest access does not persist indefinitely after a collaboration ends. | Guest accounts that remain active after collaboration has concluded represent persistent access risks - especially if the guest's own email account is later compromised. Automatic expiry forces periodic renewal, ensuring administrators review and reauthorise ongoing access. | SharePointTenantSettings.Read.All, Sites.FullControl.All - via spoTenant |
SharePoint guest users cannot share items they don't ownwt.spo.guest-resharing-disabled | MEDIUM | Checks that guest users in SharePoint are prevented from resharing content they do not own, limiting the spread of shared items beyond the original intended recipients. | If guests can reshare content, a file shared with one trusted external collaborator can be forwarded to unauthorised parties - including competitors or adversaries - without the file owner's knowledge. Preventing resharing ensures data flows through controlled sharing actions initiated by internal users. | SharePointTenantSettings.Read.All, Sites.FullControl.All - via spoTenant |
SharePoint infected files are disallowed for downloadwt.spo.infected-files-blocked | MEDIUM | Checks that SharePoint is configured to prevent users from downloading files identified by Safe Attachments scanning as containing malware. | When infected files can be downloaded from SharePoint, users may execute malicious content that was uploaded by an external collaborator or a compromised account. Blocking downloads of identified malware prevents endpoint compromise and ransomware deployment from files that have already been flagged as malicious in cloud storage. | SharePointTenantSettings.Read.All, Sites.FullControl.All - via spoTenant |
Link sharing is restricted in SharePoint and OneDrivewt.spo.link-sharing-restricted | MEDIUM | Checks that the default sharing link type in SharePoint and OneDrive is set to Direct (specific people) or Internal (people in your organisation), rather than Anyone links that allow anonymous access. | Anyone links create anonymous access URLs that can be forwarded to unauthorised parties, shared publicly, or leaked in phishing emails. By defaulting to Direct or Internal links, users must make an intentional choice to share externally, reducing accidental data exposure. | SharePointTenantSettings.Read.All, Sites.FullControl.All - via spoTenant |
Modern authentication for SharePoint applications is requiredwt.spo.modern-auth-required | MEDIUM | Checks that legacy authentication protocols are disabled for SharePoint, requiring applications to use modern OAuth 2.0-based authentication. | Legacy SharePoint authentication protocols do not support MFA or Conditional Access enforcement. Applications using legacy auth are permanently unprotected by these controls, and the credentials used can be harvested via credential-stuffing or phishing without any MFA challenge being presented. | SharePointTenantSettings.Read.All, Sites.FullControl.All - via spoTenant |
OneDrive content sharing is restrictedwt.spo.onedrive-sharing-restricted | HIGH | Checks that OneDrive external sharing is disabled (sharing capability set to 0 - Only people in your organisation), preventing users from sharing personal drive content with external parties. | OneDrive is frequently used to store sensitive personal and corporate files. Unrestricted external sharing allows users to share files with anyone on the internet, including via anonymous links. Disabling external sharing from OneDrive ensures personal drive data remains within the organisation's data governance controls. | SharePointTenantSettings.Read.All, Sites.FullControl.All - via spoTenant |
OneDrive sync is restricted for unmanaged deviceswt.spo.onedrive-sync-managed-devices-only | MEDIUM | Checks that OneDrive sync is restricted to devices joined to approved domains (managed devices), preventing sync to personal or unmanaged computers. | When OneDrive sync is allowed on unmanaged devices, a user's entire corporate document library can be downloaded to a personal computer outside corporate MDM control. If that device is lost, stolen, or compromised, all synced data is exposed. Restricting sync to managed devices ensures corporate data remains on devices subject to corporate security controls. | SharePointTenantSettings.Read.All, Sites.FullControl.All - via spoTenant |
Reauthentication with verification code is restrictedwt.spo.verification-code-reauth-restricted | MEDIUM | Checks that guests accessing SharePoint content via email verification codes are required to re-verify every 15 days or fewer, limiting how long a single verification code grants access. | Email verification codes provide time-limited access to SharePoint content for external users without an account. If reauthentication is not enforced, access granted by a single code can persist indefinitely - meaning if the verification email is forwarded or the recipient's mailbox is compromised at a later date, access remains active. | SharePointTenantSettings.Read.All, Sites.FullControl.All - via spoTenant |