The terse version of the collaboration baseline. Every action from this series, the way to check it, and a pointer to the article that argues for it. No reasoning here on purpose. If a row makes you uneasy, the argument is behind the link.
Tiers mean what they meant in the first two series. C is critical: the cost of getting it wrong is a breach or an outage and I would not sign off without it. R is recommended: I would want a reason for not doing it. O is optional: worth a decision, not worth an argument. SharePoint cmdlets assume a connected Connect-SPOService session; identity ones assume Microsoft Graph.
1. The October deadline
| Tier | Do this | How to verify | See |
|---|---|---|---|
| C | Count the external people SharePoint knows about and the guest accounts the directory holds | Get-SPOExternalUser paged, against Get-MgUser -Filter "userType eq 'Guest'" | [BP 3.1.1] |
| C | Compute the gap matching on mail, user principal name and the address encoded before #EXT# | The gap file exists and was produced by a three-attribute match, not one | [BP 3.1.1] |
| C | Have a human split the gap into accounts to create, people to let lapse, and addresses that were never a person | A reviewed file distinct from the raw gap | [BP 3.1.1] |
| C | Create the guest accounts, invitation messages suppressed, into a tracking group | SG-EXT-B2B-Backfill membership matches guests-created.csv | [BP 3.1.1] |
| C | Re-run the gap from a fresh session and confirm only deliberate exclusions remain | Count equals the number you chose to exclude | [BP 3.1.1] |
| C | Have a real external person open a pre-existing link | Opens after sign-in with no passcode prompt; a prompt means the account is not doing the work | [BP 3.1.1] |
| C | Confirm one deliberate exclusion is genuinely absent from the directory | Not present under an alias you missed | [BP 3.1.1] |
This is the only section in the series where doing nothing produces an outage on a date somebody else chose. Complete it by the end of September.
2. External trust: sharing
| Tier | Do this | How to verify | See |
|---|---|---|---|
| C | Set the organisation-level ceiling to new and existing guests | Get-SPOTenant | FL SharingCapability | [BP 3.1] |
| C | Reduce OneDrive from its anonymous default | Get-SPOTenant | FL OneDriveSharingCapability | [BP 3.1] |
| C | Reduce the tenant root site from its anonymous default | Get-SPOSite -Identity https://<tenant>.sharepoint.com | FL SharingCapability | [BP 3.1] |
| C | Audit which sites are more permissive than you expect | Get-SPOSite -Limit All filtered on SharingCapability | [BP 3.1] |
| C | Manage domain restriction in Entra, not in SharePoint, and run one list not two | Entra allow or deny list populated; the SharePoint list is not being separately maintained | [BP 3.1] |
| R | Set the default sharing link to organisation-scoped, permission view | Get-SPOTenant | FL DefaultSharingLinkType,DefaultLinkPermission | [BP 3.2] |
| R | Require expiry on anonymous links | Get-SPOTenant | FL RequireAnonymousLinksExpireInDays; unset means never | [BP 3.2] |
| R | Prevent guests resharing your content onward | Get-SPOTenant | FL PreventExternalUsersFromResharing | [BP 3.2] |
| R | Configure guest expiration for sites and OneDrive | An expiry value is set rather than left indefinite | [BP 3.2] |
Note that anonymous links are not uniformly on by default. The tenant permits them; only OneDrive and the root site can actually mint one out of the box. That is why this section is four precise changes rather than one frightening one.
3. Identity and access
| Tier | Do this | How to verify | See |
|---|---|---|---|
| C | Leave email one-time passcode enabled in Entra | External identities settings show it enabled; disabling it breaks external file sharing tenant-wide | [BP 3.1] |
| C | Treat the Entra guest controls as governing file sharing too | Guest multifactor authentication, invitation permissions and access reviews are configured in the identity baseline | [BP 1.1], [BP 3.1] |
4. External trust: Teams
| Tier | Do this | How to verify | See |
|---|---|---|---|
| C | Keep business-to-business direct connect blocked in both directions until a named partner justifies a trust | Cross-tenant access settings show inbound and outbound direct connect blocked | [BP 3.1] |
| C | Decide external access per-domain or all-domains deliberately, and record which and why | A written decision exists; the setting matches it | [BP 3.1] |
| C | Check anonymous meeting join and anonymous meeting start separately | Both values read; they are two settings and the second is the dangerous one | [BP 3.1] |
| C | Confirm trial-tenant federation is blocked | The default; confirm rather than change | [BP 3.1] |
| R | Restrict all three app permission policies to an approved set, with a maintained request path | Microsoft, third-party and custom app policies each restricted | [BP 3.2] |
| R | Default meeting recording off | Meeting policy shows recording disabled by default | [BP 3.2] |
| R | Make all three lobby decisions explicitly | Anonymous and dial-in admission, internal bypass and dial-in bypass all set deliberately | [BP 3.2] |
| R | Disable Teams email integration | Channel email addresses cannot be generated | [BP 3.2] |
| O | Disable third-party storage providers in Teams | No consumer storage options offered in the client | [BP 3.2] |
One delegation trap: a Teams administrator cannot change direct connect or select the open collaboration mode. Those need a Global Administrator, so the person who owns Teams may not be the person who owns the setting.
5. Data and email: Teams protection
| Tier | Do this | How to verify | See |
|---|---|---|---|
| C | Configure the Teams protection policy, which no preset covers | Get-TeamsProtectionPolicy | FL Name,ZapEnabled | [BP 3.1] |
| C | Confirm Safe Links and Safe Attachments actually reach Teams | Get-AtpPolicyForO365 | FL EnableATPForSPOTeamsODB; Get-SafeLinksPolicy | FT EnableSafeLinksForTeams | [BP 3.1] |
| R | Know that quarantined Teams messages are administrator-visible only and users are not notified | Documented in your own runbook, so nobody waits for a notification that never comes | [BP 3.1] |
These are Defender for Office 365 Plan 1 capabilities, and Plan 1 became part of E3 and Microsoft 365 E3 on 1 July 2026. It was already in Business Premium. If your licensing notes say this needs an upgrade, they are out of date.
6. Tenant governance and device trust
| Tier | Do this | How to verify | See |
|---|---|---|---|
| R | Apply sensitivity labels to containers, carrying privacy, sharing and device access together | Labels exist with container settings and are published to the right scope | [BP 3.2] |
| R | Configure group expiration with owner renewal, and a naming policy | Both policies exist; expiration needs a premium identity licence | [BP 3.2] |
| O | Restrict group creation only where a request process exists that people will use | A decision recorded either way, rather than a default | [BP 3.2] |
| R | Publish the answer to where new work should go | Written down and reachable from where people ask | [BP 3.2] |
| R | Restrict sync to domain-joined or compliant devices | The tenant sync restriction is set | [BP 3.2] |
| O | Block download from unmanaged devices on the sites that warrant it | Applied per site, not estate-wide | [BP 3.2] |
| R | Set OneDrive retention after account deletion against how long your business takes to notice | A chosen value, not the default | [BP 3.2] |
7. Copilot readiness
| Tier | Do this | How to verify | See |
|---|---|---|---|
| R | Run the Purview data risk assessments and the SharePoint content management assessment | Reports exist and have been read | [BP 3.3] |
| R | Export the hundred most-used sites and run the permission state report against them | A concrete list of high-risk sites rather than an intention | [BP 3.3] |
| R | Apply restricted content discovery to the sites the assessment surfaces, selectively | Start-SPORestrictedContentDiscoverabilityReport shows a deliberate, small set | [BP 3.3] |
| R | Remove the organisation-wide group, repair broken inheritance, assign owners | The only durable fix; everything above is scaffolding | [BP 3.3] |
| R | Establish whether any Copilot licence already exists in the tenant | If one does, the advanced management tooling is already available | [BP 3.3] |
| R | Set per-agent consumption limits, with notifications and a hard stop | Limits visible per agent; an owner is named | [BP 3.3] |
| R | Decide deliberately between automatic overage and service stop when credits exhaust | A billing arrangement is either linked or deliberately absent | [BP 3.3] |
Restricted content discovery is a discoverability control, not an access control. Anybody who could open the document before still can. Applied broadly it degrades the search and the assistant you are paying for, which is Microsoft’s own caution and not mine.
8. The dated items, which are not settings
| Tier | Do this | How to verify | See |
|---|---|---|---|
| C | Complete the guest inventory before October, meaning by the end of September | Section 1 of this checklist is finished | [BP 3.1.1], [BP 3.4] |
| R | Remove any runbook step that enables the Entra business-to-business integration | It is a no-op; the toggle no longer exists | [BP 3.4] |
| R | Replace anything depending on SharePoint Alerts with Rules or Power Automate | Note that Site Pages libraries do not support Rules | [BP 3.4] |
| R | Find whatever broke in April and stopped being investigated | Add-ins, the retired access control service, 2013 workflows and isolated web parts all died on one date | [BP 3.4] |
| R | Find the channel posts that stopped arriving in May | Office 365 connectors are gone; the Workflows app replaces them, and the failure was silent | [BP 3.4] |
| O | Diary the last Teams Live Events date | 28 February 2027 for events scheduled before the June retirement | [BP 3.4] |
A closing note on the reference frameworks, because someone always asks. Where a federal SCuBA control corresponds to a row above I have anchored to it, and two of its sections were removed with the numbering preserved rather than closed up, so a good deal of published commentary cites identifiers that no longer exist. Several rows here have no corresponding control at all, including everything on shared channels, container labels, group lifecycle, restricted content discovery and Copilot. That is a property of the framework rather than a gap in the row. And on one point the framework and Microsoft disagree outright: the federal baseline requires per-domain external access in Teams, while Microsoft’s own balanced preset permits all domains. The critical tier explains which of those I recommend and to whom.
Best Practices
‹ Previous: [BP 3.4] Collaboration on a Clock: Retirements and What Already Broke
