CISA.MS.SHAREPOINT.2.2 - File and folder default sharing permissions SHALL be set to View only.

Contributed by -MynsterAll contributors →

Overview

File and folder default sharing permissions SHALL be set to View only.

Rationale: Setting the default permission to View reduces the risk of accidental editing of shared documents by external parties.

Remediation action:

1. Sign in to the SharePoint admin center.
2. Select Policies > Sharing.
3. Under File and folder links, set the default link permission to View.
4. Select Save.

Related links

• CISA 2 Default Sharing Permission - MS.SHAREPOINT.2.2v1
• CISA ScubaGear Rego Reference

Test Metadata

Field	Value
Test ID	CISA.MS.SHAREPOINT.2.2
Severity	Medium
Suite	CISA
Product	SharePoint
Feature	Sharing links
Area	Access control
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1080 Taint Shared Content, T1565.001 Stored Data Manipulation
Supports benchmark	CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.SHAREPOINT.2.2
Criticality	SHALL
Upstream requirement	MS.SHAREPOINT.2.2v1
Supports controls	cisa-scuba:MS.SHAREPOINT.2.2, nist-800-53-r5:AC-6
PowerShell test	Test-MtCisaSpoDefaultSharingPermission
Services	SharePointOnline

Source

• Test: tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.2.2.ps1
• Documentation: tests/cisa/sharepoint/Test.CISA.MS.SHAREPOINT.2.2.md