CIS.M365.7.2.7 - (L1) Ensure link sharing is restricted in SharePoint and OneDrive

Contributed by -MynsterAll contributors →

Overview

7.2.7 (L1) Ensure link sharing is restricted in SharePoint and OneDrive

This setting sets the default link type that a user will see when sharing content in OneDrive or SharePoint. It does not restrict or exclude any other options. The recommended state is Specific people (only the people the user specifies) or Only people in your organization (more restrictive).

Rationale

By defaulting to specific people, the user will first need to consider whether or not the content being shared should be accessible by the entire organization versus select individuals. This aids in reinforcing the concept of least privilege.

Impact

Changing the default sharing link type influences the user experience when sharing files and folders in SharePoint and OneDrive. The configured default option will appear pre-selected in the sharing dialog, guiding users toward the organization's preferred sharing method.

October 2026 service change: Microsoft is retiring SharePoint one-time passcode (OTP) authentication for commercial tenants. As retirement reaches a tenant, external users without a matching Microsoft Entra B2B guest account can lose access to previously shared Specific people links. Changing the default link type affects new links; it does not repair access to existing links. To restore access, create a matching guest account or share or reshare at least one item or site with that person. Microsoft Entra B2B email OTP remains supported.

Remediation

1. Navigate to SharePoint admin center
2. Click to expand Policies > Sharing.
3. Scroll to File and folder links.
4. Set Choose the type of link that's selected by default when users share files and folders in SharePoint and OneDrive to Specific people (only the people the user specifies) or Only people in your organization.

PowerShell

1. Connect to SharePoint Online using Connect-SPOService
2. Run the following command:

Set-SPOTenant -DefaultSharingLinkType Direct

1. Or, to set a more restrictive state:

Set-SPOTenant -DefaultSharingLinkType Internal

Default Value: Only people in your organization (Internal)

Related Links

• Set-SPOTenant
• Microsoft Entra B2B integration and SharePoint OTP retirement
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 480

Test Metadata

Field	Value
Test ID	CIS.M365.7.2.7
Severity	Medium
Suite	CIS
Product	SharePoint
Feature	Sharing links
Area	Access control
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1213.002 Sharepoint
Supports benchmark	CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 7.2.7
Benchmark level	L1
Benchmark profiles	E3 Level 1, E5 Level 1
Supports controls	cis-m365:7.2.7, nist-800-53-r5:AC-3, nist-800-53-r5:AC-6
PowerShell test	Test-MtCisSpoDefaultSharingLink
Services	SharePointOnline

Source

• Test: tests/cis/Test.CIS.M365.7.2.7.ps1
• Documentation: tests/cis/Test.CIS.M365.7.2.7.md