CISA.MS.SHAREPOINT.3.1 - Expiration days for Anyone links SHALL be set to 30 days or less.

Overview

Expiration days for Anyone links SHALL be set to 30 days or less.

Rationale: Anyone links that do not expire or have excessively long expiration periods pose a persistent risk of unauthorized access. Setting an expiration of 30 days or less ensures that shared content access is time-limited.

Remediation action:

1. Sign in to the SharePoint admin center.
2. Select Policies > Sharing.
3. Under Advanced settings for Anyone links, check These links must expire within this many days and set to 30 days or less.
4. Select Save.

Related links

• CISA 3 Anyone Link Expiration - MS.SHAREPOINT.3.1v1
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.SHAREPOINT.3.1
Severity	Unknown
Suite	CISA
Category	spo
PowerShell test	Test-MtCisaSpoAnyoneLinkExpiration
Tags	CISA, CISA.MS.SHAREPOINT.3.1, MS.SHAREPOINT, MS.SHAREPOINT.3.1

Source

• Pester test: tests/cisa/spo/Test-MtCisaSpoAnyoneLinkExpiration.Tests.ps1
• PowerShell source: powershell/public/cisa/spo/Test-MtCisaSpoAnyoneLinkExpiration.ps1