fix(sharepoint): false positives on disabled external sharing (#9298)

prowler/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to the **Prowler SDK** are documented in this file.
 
+## [v5.14.1] (Prowler UNRELEASED)
+
+### Fixed
+- Fix `sharepoint_external_sharing_managed` check to handle external sharing disabled at organization level [(#9298)](https://github.com/prowler-cloud/prowler/pull/9298)
+
+---
+
 ## [v5.14.0] (Prowler v5.14.0)
 
 ### Added

prowler/providers/m365/services/sharepoint/sharepoint_external_sharing_managed/sharepoint_external_sharing_managed.py

@@ -11,12 +11,9 @@ class sharepoint_external_sharing_managed(Check):
     Check if Microsoft 365 SharePoint external sharing is managed through domain whitelists/blacklists.
 
     This check verifies that SharePoint external sharing settings are configured to restrict document sharing
-    to external domains by enforcing domain-based restrictions. This means that the setting
-    'sharingDomainRestrictionMode' must be set to either "AllowList" or "BlockList". If it is not, then
-    external sharing is not managed via domain restrictions, increasing the risk of unauthorized access.
-
-    Note: This check only evaluates the domain restriction mode and does not enforce the optional check
-    of verifying that the allowed/blocked domain list is not empty.
+    to external domains by enforcing domain-based restrictions. When external sharing is enabled, the setting
+    'sharingDomainRestrictionMode' must be set to either "AllowList" or "BlockList" with a corresponding
+    domain list. If external sharing is disabled at the organization level, the check passes.
     """
 
     def execute(self) -> List[CheckReportM365]:
@@ -40,7 +37,12 @@ class sharepoint_external_sharing_managed(Check):
             )
             report.status = "FAIL"
             report.status_extended = "SharePoint external sharing is not managed through domain restrictions."
-            if settings.sharingDomainRestrictionMode in ["allowList", "blockList"]:
+            if settings.sharingCapability == "Disabled":
+                report.status = "PASS"
+                report.status_extended = (
+                    "External sharing is disabled at organization level."
+                )
+            elif settings.sharingDomainRestrictionMode in ["allowList", "blockList"]:
                 report.status_extended = f"SharePoint external sharing is managed through domain restrictions with mode '{settings.sharingDomainRestrictionMode}' but the list is empty."
                 if (
                     settings.sharingDomainRestrictionMode == "allowList"

tests/providers/m365/services/sharepoint/sharepoint_external_sharing_managed/sharepoint_external_sharing_managed_test.py

@@ -55,6 +55,53 @@ class Test_sharepoint_external_sharing_managed:
             assert result[0].resource_name == "SharePoint Settings"
             assert result[0].resource == sharepoint_client.settings.dict()
 
+    def test_external_sharing_disabled(self):
+        """
+        Test when external sharing is disabled at organization level:
+        The check should PASS since domain restrictions are not applicable.
+        """
+        sharepoint_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch("prowler.providers.m365.lib.service.service.M365PowerShell"),
+            mock.patch(
+                "prowler.providers.m365.services.sharepoint.sharepoint_external_sharing_managed.sharepoint_external_sharing_managed.sharepoint_client",
+                new=sharepoint_client,
+            ),
+        ):
+            from prowler.providers.m365.services.sharepoint.sharepoint_external_sharing_managed.sharepoint_external_sharing_managed import (
+                sharepoint_external_sharing_managed,
+            )
+
+            sharepoint_client.settings = SharePointSettings(
+                sharingCapability="Disabled",
+                sharingAllowedDomainList=[],
+                sharingBlockedDomainList=[],
+                legacyAuth=True,
+                resharingEnabled=False,
+                sharingDomainRestrictionMode="none",
+                allowedDomainGuidsForSyncApp=[uuid.uuid4()],
+            )
+            sharepoint_client.tenant_domain = DOMAIN
+
+            check = sharepoint_external_sharing_managed()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "External sharing is disabled at organization level."
+            )
+            assert result[0].resource_id == "sharepointSettings"
+            assert result[0].location == "global"
+            assert result[0].resource_name == "SharePoint Settings"
+            assert result[0].resource == sharepoint_client.settings.dict()
+
     def test_allow_list_empty(self):
         """
         Test when sharingDomainRestrictionMode is "allowList" but AllowedDomainList is empty: