Expiration days for Anyone links SHALL be set to 30 days or less

Contributed by -MynsterAll contributors →

Part of CISA · SharePoint · Sharing links · All checks

Run this check

Invoke-Maester -TestId CISA.MS.SHAREPOINT.3.1

Overview

Expiration days for Anyone links SHALL be set to 30 days or less.

Rationale: Anyone links that do not expire or have excessively long expiration periods pose a persistent risk of unauthorized access. Setting an expiration of 30 days or less ensures that shared content access is time-limited.

Remediation action:

1. Sign in to the SharePoint admin center.
2. Select Policies > Sharing.
3. Under Advanced settings for Anyone links, check These links must expire within this many days and set to 30 days or less.
4. Select Save.

Related links

• CISA 3 Anyone Link Expiration - MS.SHAREPOINT.3.1v1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.SHAREPOINT.3.1
Severity	Medium
Suite	CISA
Product	SharePoint
Feature	Sharing links
Area	External access and sharing
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1048 Exfiltration Over Alternative Protocol, T1213.002 Sharepoint, T1530 Data from Cloud Storage
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.SHAREPOINT.3.1
Criticality	SHALL
Upstream requirement	MS.SHAREPOINT.3.1v1
Supports controls	cisa-scuba:MS.SHAREPOINT.3.1, nist-800-53-r5:AC-3, nist-800-53-r5:AC-21b
PowerShell test	Test-MtCisaSpoAnyoneLinkExpiration
Services	SharePointOnline

Source

• Test: tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.3.1.ps1
• Documentation: tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.3.1.md