Allowable file and folder permissions for Anyone links SHALL be set to View only

Contributed by -MynsterAll contributors →

Part of CISA · SharePoint · Sharing links · All checks

Run this check

Invoke-Maester -TestId CISA.MS.SHAREPOINT.3.2

Overview

Allowable file and folder permissions for Anyone links SHALL be set to View only.

Rationale: Allowing edit permissions on Anyone links increases the risk of unauthorized modifications to shared content. Restricting to View only limits the potential impact of anonymous access.

Remediation action:

1. Sign in to the SharePoint admin center.
2. Select Policies > Sharing.
3. Under Advanced settings for Anyone links, set the file and folder permissions to View.
4. Select Save.

Related links

• CISA 3 Anyone Link Permission - MS.SHAREPOINT.3.2v1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.SHAREPOINT.3.2
Severity	Medium
Suite	CISA
Product	SharePoint
Feature	Sharing links
Area	External access and sharing
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1080 Taint Shared Content, T1565.001 Stored Data Manipulation
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.SHAREPOINT.3.2
Criticality	SHALL
Upstream requirement	MS.SHAREPOINT.3.2v1
Supports controls	cisa-scuba:MS.SHAREPOINT.3.2, nist-800-53-r5:AC-6
PowerShell test	Test-MtCisaSpoAnyoneLinkPermission
Services	SharePointOnline

Source

• Test: tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.3.2.ps1
• Documentation: tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.3.2.md