CIS.M365.7.2.11 - (L1) Ensure the SharePoint default sharing link permission is set

Contributed by -MynsterAll contributors →

Overview

7.2.11 (L1) Ensure the SharePoint default sharing link permission is set

This setting configures the permission that is selected by default for sharing link from a SharePoint site.

The recommended state is View.

Rationale

Setting the view permission as the default ensures that users must deliberately select the edit permission when sharing a link. This approach reduces the risk of unintentionally granting edit privileges to a resource that only requires read access, supporting the principle of least privilege.

Impact

Not applicable.

Remediation

1. Navigate to SharePoint admin center
2. Click to expand Policies > Sharing.
3. Scroll to File and folder links.
4. Ensure Choose the permission that's selected by default for sharing links is set to View.

PowerShell

1. Connect to SharePoint Online using Connect-SPOService
2. Run the following command:

Set-SPOTenant -DefaultLinkPermission View

Default Value: DefaultLinkPermission : Edit

Related Links

• Manage sharing settings for SharePoint and OneDrive in Microsoft 365
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 493

Test Metadata

Field	Value
Test ID	CIS.M365.7.2.11
Severity	Medium
Suite	CIS
Product	SharePoint
Feature	Sharing links
Area	Access control
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1080 Taint Shared Content, T1565.001 Stored Data Manipulation
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 7.2.11
Benchmark level	L1
Benchmark profiles	E3 Level 1, E5 Level 1
Supports controls	cis-m365:7.2.11, nist-800-53-r5:AC-6
PowerShell test	Test-MtCisSpoDefaultSharingLinkPermission
Services	SharePointOnline

Source

• Test: tests/cis/Test.CIS.M365.7.2.11.ps1
• Documentation: tests/cis/Test.CIS.M365.7.2.11.md