Add a new SharePoint Guest sign in Policy

[Sloane4]

💡 Summary

Add a policy to the SharePoint Baseline that directs the user to enable the setting "Guests might sign in using the same account to which sharing invitations are sent".

Motivation and context

This is a checkbox in the SP admin portal. It might help scenarios where a prospective guest user’s mailbox has been compromised and the attacker steals the sharing link, then creates an account with their own email address. With the setting enabled the attacker will not be able to use the link to access the content.

Implementation notes

• Add 2.6 to Baseline
• Find power shell command that returns the value for the checkbox setting
• Add Rego code that checks the configuration for the new policy
• Create Unit test cases for new policy
• Update/create new functional tests for new policy

Acceptance criteria

• Updated policy has the change noted in implementation notes
• All unit test cases pass
• All functional test pass

[gdasher]

Approved for adding this at the SHOULD level.

[Sloane4]

Setting is RequireAcceptingAccountMatchInvitedAccount

[Sloane4]

because the setting is related to & modified with similar steps, recommend adding to External sharing as MS.SHAREPOINT.4.3v1