Skip to content

Microsoft 365 data sharing & exposure security checks

External sharing, public links, guest access, retention and data-protection settings that quietly push company data outside the tenant.

On Microsoft 365, Black Cat runs 22 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Microsoft 365 connector needs.

Checks (22)

severity: medium Guest Access to Group Content Not Restricted fix difficulty: easy #

Limit M365 guest visibility to group content and directory objects

  1. Navigate to Microsoft Entra admin center > Identity > External Identities > External collaboration settings
  2. Set guest users to have limited access to directory object properties and memberships
  3. Review downstream M365 sharing settings to ensure guest visibility matches policy
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

severity: high Organization Sharing Enabled fix difficulty: medium #

Review and restrict M365 organization sharing relationships that are not business-required

  1. Navigate to Exchange Admin Center > Organization > Sharing
  2. Review existing organization sharing relationships
  3. Remove or restrict sharing relationships that are not business-required
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

severity: high Default Calendar Sharing Too Permissive fix difficulty: easy #

Restrict M365 default calendar sharing policy to Free/Busy time information only

  1. Navigate to Exchange Admin Center > Organization > Sharing
  2. Edit the default sharing policy
  3. Restrict calendar sharing to Free/Busy information only
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

severity: medium Default Group Access Public fix difficulty: easy #

Set M365 default group access type to Private via Exchange Online PowerShell

  1. Connect to Exchange Online PowerShell
  2. Run Set-OrganizationConfig -DefaultGroupAccessType Private
  3. Verify with Get-OrganizationConfig | Select DefaultGroupAccessType

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

severity: medium External Forwarding on Mailbox fix difficulty: easy #

Remove external forwarding configuration from M365 mailboxes to prevent data exfiltration

  1. Connect to Exchange Online PowerShell
  2. Run Set-Mailbox -Identity <user> -ForwardingAddress $null -ForwardingSmtpAddress $null
  3. Verify the forwarding has been removed
  4. Consider creating a transport rule to block external forwarding globally

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

severity: medium Mailbox Delivers to Both Mailbox and Forward fix difficulty: easy #

Disable dual delivery on M365 mailboxes and deliver only to the primary mailbox

  1. Connect to Exchange Online PowerShell
  2. Run Set-Mailbox -Identity <user> -DeliverToMailboxAndForward $false
  3. Verify the mailbox only delivers to the primary mailbox

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

severity: high Forwarding SMTP to External fix difficulty: easy #

Remove external SMTP forwarding from M365 mailboxes and create a transport rule to block it

  1. Connect to Exchange Online PowerShell
  2. Run Set-Mailbox -Identity <user> -ForwardingSmtpAddress $null
  3. Create a transport rule to block external SMTP forwarding
  4. Verify no mailboxes have external forwarding configured

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

severity: low Forwarding Address Configured fix difficulty: easy #

Remove the forwarding address from M365 mailboxes to prevent unauthorized email redirection

  1. Connect to Exchange Online PowerShell
  2. Run Set-Mailbox -Identity <user> -ForwardingAddress $null
  3. Verify the forwarding address has been removed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

severity: medium LinkedIn Integration Enabled in OWA fix difficulty: easy #

Disable LinkedIn integration in M365 Outlook Web Access to prevent data sharing

  1. Connect to Exchange Online PowerShell
  2. Run Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -LinkedInEnabled $false
  3. Verify with Get-OwaMailboxPolicy | Select LinkedInEnabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

severity: medium Mobile Contact Sync Enabled in OWA fix difficulty: easy #

Disable mobile contact sync in M365 OWA to prevent contact data leakage

  1. Connect to Exchange Online PowerShell
  2. Run Set-OwaMailboxPolicy -Identity OwaMailboxPolicy-Default -AllowOfflineOn NoComputers
  3. Disable contact sync through mobile device policies
  4. Verify with Get-OwaMailboxPolicy

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

severity: high Transport Rule Redirects Externally fix difficulty: medium #

Remove or modify M365 transport rules that redirect mail to external SMTP addresses

  1. Navigate to Exchange Admin Center > Mail Flow > Rules
  2. Identify transport rules that redirect mail to external SMTP addresses
  3. Remove or modify the rule to prevent external redirection
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

severity: high Transport Rule Forwards Outside Org fix difficulty: medium #

Remove or modify M365 transport rules that forward mail outside the organization

  1. Navigate to Exchange Admin Center > Mail Flow > Rules
  2. Identify transport rules that forward mail outside the organization
  3. Remove or modify the rule to restrict external forwarding
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

severity: high Remote Domain Auto-Forwarding Allowed fix difficulty: easy #

Disable auto-forwarding to external domains in M365 remote domain settings

  1. Connect to Exchange Online PowerShell
  2. Run Set-RemoteDomain -Identity Default -AutoForwardEnabled $false
  3. Verify with Get-RemoteDomain | Select AutoForwardEnabled

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

severity: medium Default Sharing Policy Allows External fix difficulty: easy #

Restrict M365 default sharing policy to Free/Busy information only

  1. Navigate to Exchange Admin Center > Organization > Sharing
  2. Edit the default sharing policy
  3. Restrict external sharing to Free/Busy time only
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

severity: low Sharing Policy Allows External Domains fix difficulty: easy #

Restrict M365 sharing policies to specific trusted domains or disable external sharing

  1. Navigate to Exchange Admin Center > Organization > Sharing
  2. Review sharing policies that allow sharing with external domains
  3. Restrict to specific trusted domains or disable external sharing
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

severity: medium Distribution List Allows External Senders fix difficulty: easy #

Restrict M365 distribution list delivery to internal senders only

  1. Navigate to Exchange Admin Center > Recipients > Groups
  2. Select the distribution list that allows external senders
  3. Edit message delivery and restrict to internal senders only
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

severity: medium Distribution Group Open Join Policy fix difficulty: easy #

Change M365 distribution group join policy to Closed or Owner Approval required

  1. Navigate to Exchange Admin Center > Recipients > Groups
  2. Select the group with open join policy
  3. Change the Membership Approval to Closed or Owner Approval
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

severity: medium Public Microsoft 365 Group fix difficulty: easy #

Change public M365 groups to Private to restrict membership visibility

  1. Navigate to Microsoft 365 Admin Center > Groups > Active Groups
  2. Select the public Microsoft 365 group
  3. Change the privacy setting from Public to Private
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-44.1 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

severity: medium Outbound Spam External Forwarding Allowed fix difficulty: easy #

Block automatic external forwarding in M365 Defender outbound spam policy

  1. Navigate to Microsoft 365 Defender > Policies > Anti-Spam > Outbound
  2. Edit the outbound spam policy
  3. Set Automatic Forwarding to Off or Automatic - System Controlled
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-28.3 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

severity: high Copilot Agent Tenant-Wide Sharing fix difficulty: easy #

Restrict agent sharing to specific users or groups instead of entire tenant

  1. Open Power Platform Admin Center > Copilot Studio
  2. Select the agent and go to sharing settings
  3. Remove entire-tenant sharing and add specific users/groups

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

severity: medium Copilot Agent Broad Sharing fix difficulty: easy #

Reduce the number of shared viewers to under 10 users / 3 groups

  1. Open Power Platform Admin Center > Copilot Studio
  2. Select the agent and review sharing settings
  3. Remove unnecessary viewers

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

severity: medium Copilot Agent Web Search Enabled fix difficulty: easy #

Disable web search for knowledge if not required

  1. Open Power Platform Admin Center > Copilot Studio
  2. Select the agent and go to Knowledge settings
  3. Disable web search

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.12

More Microsoft 365 checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial