# File and folder default sharing scope SHALL be set to Specific People

File and folder default sharing scope SHALL be set to Specific People (only the people the user specifies).

Source: https://maester.dev/docs/tests/CISA.MS.SHAREPOINT.2.1

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/mynster9361" title="-Mynster · Original author"><img src="https://github.com/Mynster9361.png" alt="-Mynster" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/mynster9361">-Mynster</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cisa">CISA</a> · SharePoint · Sharing links · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CISA.MS.SHAREPOINT.2.1
```

## Overview

File and folder default sharing scope SHALL be set to Specific People (only the people the user specifies).

Rationale: Overly permissive default sharing settings increase the risk of unintentional data exposure. Setting the default to Specific People ensures users make deliberate sharing decisions.

#### Remediation action:

1. Sign in to the [SharePoint admin center](https://go.microsoft.com/fwlink/?linkid=2185219).
2. Select Policies > Sharing.
3. Under File and folder links, set the default link type to **Specific people (only the people the user specifies)**.
4. Select Save.

#### Related links

* [CISA 2 Default Sharing Scope - MS.SHAREPOINT.2.1v1](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/sharepoint.md#mssharepoint21v1)
* [CISA ScubaGear Rego Reference](https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/Rego/SharepointConfig.rego)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CISA.MS.SHAREPOINT.2.1 |
| Severity | Medium |
| Suite | CISA |
| Product | SharePoint |
| Feature | Sharing links |
| Area | Access control |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1048 Exfiltration Over Alternative Protocol, T1213.002 Sharepoint |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.SHAREPOINT.2.1 |
| Criticality | SHALL |
| Upstream requirement | MS.SHAREPOINT.2.1v1 |
| Supports controls | cisa-scuba:MS.SHAREPOINT.2.1, nist-800-53-r5:AC-6 |
| PowerShell test | [Test-MtCisaSpoDefaultSharingScope](https://github.com/maester365/maester/blob/main/tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.2.1.ps1) |
| Services | SharePointOnline |

</details>

## Source

- Test: [`tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.2.1.ps1`](https://github.com/maester365/maester/blob/main/tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.2.1.ps1)
- Documentation: [`tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.2.1.md`](https://github.com/maester365/maester/blob/main/tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.2.1.md)