CISA.MS.SHAREPOINT.2.1 - File and folder default sharing scope SHALL be set to Specific People.
Overview
File and folder default sharing scope SHALL be set to Specific People (only the people the user specifies).
Rationale: Overly permissive default sharing settings increase the risk of unintentional data exposure. Setting the default to Specific People ensures users make deliberate sharing decisions.
Remediation action:
- Sign in to the SharePoint admin center.
- Select Policies > Sharing.
- Under File and folder links, set the default link type to Specific people (only the people the user specifies).
- Select Save.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CISA.MS.SHAREPOINT.2.1 |
| Severity | Medium |
| Suite | CISA |
| Product | SharePoint |
| Feature | Sharing links |
| Area | Access control |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1048 Exfiltration Over Alternative Protocol, T1213.002 Sharepoint |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.SHAREPOINT.2.1 |
| Criticality | SHALL |
| Upstream requirement | MS.SHAREPOINT.2.1v1 |
| Supports controls | cisa-scuba:MS.SHAREPOINT.2.1, nist-800-53-r5:AC-6 |
| PowerShell test | Test-MtCisaSpoDefaultSharingScope |
| Services | SharePointOnline |