File and folder default sharing permissions SHALL be set to View only

Contributed by -MynsterAll contributors →

Part of CISA · SharePoint · Sharing links · All checks

Run this check

Invoke-Maester -TestId CISA.MS.SHAREPOINT.2.2

Overview

File and folder default sharing permissions SHALL be set to View only.

Rationale: Setting the default permission to View reduces the risk of accidental editing of shared documents by external parties.

Remediation action:

1. Sign in to the SharePoint admin center.
2. Select Policies > Sharing.
3. Under File and folder links, set the default link permission to View.
4. Select Save.

Related links

• CISA 2 Default Sharing Permission - MS.SHAREPOINT.2.2v1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.SHAREPOINT.2.2
Severity	Medium
Suite	CISA
Product	SharePoint
Feature	Sharing links
Area	Access control
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1080 Taint Shared Content, T1565.001 Stored Data Manipulation
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.SHAREPOINT.2.2
Criticality	SHALL
Upstream requirement	MS.SHAREPOINT.2.2v1
Supports controls	cisa-scuba:MS.SHAREPOINT.2.2, nist-800-53-r5:AC-6
PowerShell test	Test-MtCisaSpoDefaultSharingPermission
Services	SharePointOnline

Source

• Test: tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.2.2.ps1
• Documentation: tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.2.2.md