File and folder default sharing scope SHALL be set to Specific People

Contributed by -MynsterAll contributors →

Part of CISA · SharePoint · Sharing links · All checks

Run this check

Invoke-Maester -TestId CISA.MS.SHAREPOINT.2.1

Overview

File and folder default sharing scope SHALL be set to Specific People (only the people the user specifies).

Rationale: Overly permissive default sharing settings increase the risk of unintentional data exposure. Setting the default to Specific People ensures users make deliberate sharing decisions.

Remediation action:

1. Sign in to the SharePoint admin center.
2. Select Policies > Sharing.
3. Under File and folder links, set the default link type to Specific people (only the people the user specifies).
4. Select Save.

Related links

• CISA 2 Default Sharing Scope - MS.SHAREPOINT.2.1v1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.SHAREPOINT.2.1
Severity	Medium
Suite	CISA
Product	SharePoint
Feature	Sharing links
Area	Access control
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1048 Exfiltration Over Alternative Protocol, T1213.002 Sharepoint
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.SHAREPOINT.2.1
Criticality	SHALL
Upstream requirement	MS.SHAREPOINT.2.1v1
Supports controls	cisa-scuba:MS.SHAREPOINT.2.1, nist-800-53-r5:AC-6
PowerShell test	Test-MtCisaSpoDefaultSharingScope
Services	SharePointOnline

Source

• Test: tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.2.1.ps1
• Documentation: tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.2.1.md