Reauthentication days for people who use a verification code SHALL be set to 30 days or less

Contributed by -MynsterAll contributors →

Part of CISA · SharePoint · External sharing · All checks

Run this check

Invoke-Maester -TestId CISA.MS.SHAREPOINT.3.3

Overview

Reauthentication days for people who use a verification code SHALL be set to 30 days or less.

Rationale: Requiring periodic reauthentication via verification codes ensures that external users maintain valid access and reduces the risk of prolonged unauthorized access through stale sessions.

Remediation action:

1. Sign in to the SharePoint admin center.
2. Select Policies > Sharing.
3. Under Advanced settings, check Guests must sign in using the same account to which sharing invitations are sent.
4. Check People who use a verification code must reauthenticate after this many days and set to 30 days or less.
5. Select Save.

Related links

• CISA 3 Verification Code Reauth - MS.SHAREPOINT.3.3v1
• CISA ScubaGear Rego Reference

Details

Every attribute of this check

Field	Value
Test ID	CISA.MS.SHAREPOINT.3.3
Severity	Medium
Suite	CISA
Product	SharePoint
Feature	External sharing
Area	Authentication
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1213.002 Sharepoint, T1530 Data from Cloud Storage
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.SHAREPOINT.3.3
Criticality	SHALL
Upstream requirement	MS.SHAREPOINT.3.3v2
Supports controls	cisa-scuba:MS.SHAREPOINT.3.3, nist-800-53-r5:IA-11
PowerShell test	Test-MtCisaSpoVerificationCodeReauth
Services	SharePointOnline

Source

• Test: tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.3.3.ps1
• Documentation: tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.3.3.md