CIS.M365.7.2.10 - (L1) Ensure reauthentication with verification code is restricted
Overview
Guests who sign in with a one-time verification code prove access by reading an email sent to their address. If the verification is not repeated for a long time, a guest whose mailbox or account has been compromised keeps access to shared SharePoint content without a new check.
Requiring guests to verify again every 15 days or less limits how long a stale or compromised guest account keeps working. Guests sign in again with a new code each time, which is a small extra step for them.
Remediation action
- Sign in to the SharePoint admin center.
- Go to Policies > Sharing.
- Expand More external sharing settings.
- Select People who use a verification code must reauthenticate after this many days and enter 15 or fewer.
- Select Save.
In commercial tenants, Microsoft Entra B2B integration is enabled by default for new external sharing, and Entra guest settings take precedence over these SharePoint values for new guests. Microsoft began retiring SharePoint OTP for commercial tenants in October 2026; Microsoft Entra B2B email OTP remains supported. This test still audits the SharePoint values specified by CIS 7.2.10 and does not check the Entra B2B authentication or reauthentication policy. See CIS 5.2.3.7 for the recommended Email OTP configuration.
To apply the setting with PowerShell, connect with Connect-PnPOnline -Url https://<tenant>-admin.sharepoint.com -Interactive and run:
Set-PnPTenant -EmailAttestationRequired $true -EmailAttestationReAuthDays 15
Related links
- SharePoint admin center
- Manage sharing settings for SharePoint and OneDrive in Microsoft 365
- Email one-time passcode authentication for B2B guest users
- Microsoft Entra B2B integration and SharePoint OTP retirement
- Set-PnPTenant
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 7.2.10
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.7.2.10 |
| Severity | Medium |
| Suite | CIS |
| Product | SharePoint |
| Feature | External sharing |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 7.2.10 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:7.2.10, nist-800-53-r5:IA-5 |
| PowerShell test | Test-MtCisSpoGuestReauthentication |
| Services | SharePointOnline |
Source
- Test:
tests/cis/Test.CIS.M365.7.2.10.ps1 - Documentation:
tests/cis/Test.CIS.M365.7.2.10.md