CIS.M365.7.2.10 - (L1) Ensure reauthentication with verification code is restricted
Overview
Guests who sign in with a one-time verification code prove access by reading an email sent to their address. If the verification is not repeated for a long time, a guest whose mailbox or account has been compromised keeps access to shared SharePoint content without a new check.
Requiring guests to verify again every 15 days or less limits how long a stale or compromised guest account keeps working. Guests sign in again with a new code each time, which is a small extra step for them.
Remediation action
- Sign in to the SharePoint admin center.
- Go to Policies > Sharing.
- Expand More external sharing settings.
- Select People who use a verification code must reauthenticate after this many days and enter 15 or fewer.
- Select Save.
When SharePoint and OneDrive integration with Microsoft Entra B2B is turned on (CIS 7.2.2), Microsoft Entra guest settings take precedence over this setting for new guests. This test still audits the SharePoint values as defined by CIS 7.2.10. See CIS 5.2.3.7 for the recommended Email OTP configuration.
To apply the setting with PowerShell, connect with Connect-PnPOnline -Url https://<tenant>-admin.sharepoint.com -Interactive and run:
Set-PnPTenant -EmailAttestationRequired $true -EmailAttestationReAuthDays 15
Related links
- SharePoint admin center
- Manage sharing settings for SharePoint and OneDrive in Microsoft 365
- Email one-time passcode authentication for B2B guest users
- Set-PnPTenant
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 7.2.10
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.7.2.10 |
| Severity | Medium |
| Suite | CIS |
| Product | SharePoint |
| Feature | External sharing |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 7.2.10 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:7.2.10, nist-800-53-r5:IA-5 |
| PowerShell test | Test-MtCisSpoGuestReauthentication |
| Services | SharePointOnline |
Source
- Test:
tests/cis/Test.CIS.M365.7.2.10.ps1 - Documentation:
tests/cis/Test.CIS.M365.7.2.10.md