CISA.MS.SHAREPOINT.2.1 - File and folder default sharing scope SHALL be set to Specific People.

Overview

File and folder default sharing scope SHALL be set to Specific People (only the people the user specifies).

Rationale: Overly permissive default sharing settings increase the risk of unintentional data exposure. Setting the default to Specific People ensures users make deliberate sharing decisions.

Remediation action:

1. Sign in to the SharePoint admin center.
2. Select Policies > Sharing.
3. Under File and folder links, set the default link type to Specific people (only the people the user specifies).
4. Select Save.

Related links

• CISA 2 Default Sharing Scope - MS.SHAREPOINT.2.1v1
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.SHAREPOINT.2.1
Severity	Unknown
Suite	CISA
Category	spo
PowerShell test	Test-MtCisaSpoDefaultSharingScope
Tags	CISA, CISA.MS.SHAREPOINT.2.1, MS.SHAREPOINT, MS.SHAREPOINT.2.1

Source

• Pester test: tests/cisa/spo/Test-MtCisaSpoDefaultSharingScope.Tests.ps1
• PowerShell source: powershell/public/cisa/spo/Test-MtCisaSpoDefaultSharingScope.ps1