diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 4d30546382..7ca71f55f2 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -2,6 +2,13 @@ All notable changes to the **Prowler SDK** are documented in this file. +## [v5.14.1] (Prowler UNRELEASED) + +### Fixed +- Fix `sharepoint_external_sharing_managed` check to handle external sharing disabled at organization level [(#9298)](https://github.com/prowler-cloud/prowler/pull/9298) + +--- + ## [v5.14.0] (Prowler v5.14.0) ### Added diff --git a/prowler/providers/m365/services/sharepoint/sharepoint_external_sharing_managed/sharepoint_external_sharing_managed.py b/prowler/providers/m365/services/sharepoint/sharepoint_external_sharing_managed/sharepoint_external_sharing_managed.py index fad421d3d9..1b2de5ec85 100644 --- a/prowler/providers/m365/services/sharepoint/sharepoint_external_sharing_managed/sharepoint_external_sharing_managed.py +++ b/prowler/providers/m365/services/sharepoint/sharepoint_external_sharing_managed/sharepoint_external_sharing_managed.py @@ -11,12 +11,9 @@ class sharepoint_external_sharing_managed(Check): Check if Microsoft 365 SharePoint external sharing is managed through domain whitelists/blacklists. This check verifies that SharePoint external sharing settings are configured to restrict document sharing - to external domains by enforcing domain-based restrictions. This means that the setting - 'sharingDomainRestrictionMode' must be set to either "AllowList" or "BlockList". If it is not, then - external sharing is not managed via domain restrictions, increasing the risk of unauthorized access. - - Note: This check only evaluates the domain restriction mode and does not enforce the optional check - of verifying that the allowed/blocked domain list is not empty. + to external domains by enforcing domain-based restrictions. When external sharing is enabled, the setting + 'sharingDomainRestrictionMode' must be set to either "AllowList" or "BlockList" with a corresponding + domain list. If external sharing is disabled at the organization level, the check passes. """ def execute(self) -> List[CheckReportM365]: @@ -40,7 +37,12 @@ class sharepoint_external_sharing_managed(Check): ) report.status = "FAIL" report.status_extended = "SharePoint external sharing is not managed through domain restrictions." - if settings.sharingDomainRestrictionMode in ["allowList", "blockList"]: + if settings.sharingCapability == "Disabled": + report.status = "PASS" + report.status_extended = ( + "External sharing is disabled at organization level." + ) + elif settings.sharingDomainRestrictionMode in ["allowList", "blockList"]: report.status_extended = f"SharePoint external sharing is managed through domain restrictions with mode '{settings.sharingDomainRestrictionMode}' but the list is empty." if ( settings.sharingDomainRestrictionMode == "allowList" diff --git a/tests/providers/m365/services/sharepoint/sharepoint_external_sharing_managed/sharepoint_external_sharing_managed_test.py b/tests/providers/m365/services/sharepoint/sharepoint_external_sharing_managed/sharepoint_external_sharing_managed_test.py index 870cd1f3c4..f9fd507da3 100644 --- a/tests/providers/m365/services/sharepoint/sharepoint_external_sharing_managed/sharepoint_external_sharing_managed_test.py +++ b/tests/providers/m365/services/sharepoint/sharepoint_external_sharing_managed/sharepoint_external_sharing_managed_test.py @@ -55,6 +55,53 @@ class Test_sharepoint_external_sharing_managed: assert result[0].resource_name == "SharePoint Settings" assert result[0].resource == sharepoint_client.settings.dict() + def test_external_sharing_disabled(self): + """ + Test when external sharing is disabled at organization level: + The check should PASS since domain restrictions are not applicable. + """ + sharepoint_client = mock.MagicMock + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_m365_provider(), + ), + mock.patch("prowler.providers.m365.lib.service.service.M365PowerShell"), + mock.patch( + "prowler.providers.m365.services.sharepoint.sharepoint_external_sharing_managed.sharepoint_external_sharing_managed.sharepoint_client", + new=sharepoint_client, + ), + ): + from prowler.providers.m365.services.sharepoint.sharepoint_external_sharing_managed.sharepoint_external_sharing_managed import ( + sharepoint_external_sharing_managed, + ) + + sharepoint_client.settings = SharePointSettings( + sharingCapability="Disabled", + sharingAllowedDomainList=[], + sharingBlockedDomainList=[], + legacyAuth=True, + resharingEnabled=False, + sharingDomainRestrictionMode="none", + allowedDomainGuidsForSyncApp=[uuid.uuid4()], + ) + sharepoint_client.tenant_domain = DOMAIN + + check = sharepoint_external_sharing_managed() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == "External sharing is disabled at organization level." + ) + assert result[0].resource_id == "sharepointSettings" + assert result[0].location == "global" + assert result[0].resource_name == "SharePoint Settings" + assert result[0].resource == sharepoint_client.settings.dict() + def test_allow_list_empty(self): """ Test when sharingDomainRestrictionMode is "allowList" but AllowedDomainList is empty: