CISA.MS.SHAREPOINT.3.1 - Expiration days for Anyone links SHALL be set to 30 days or less.
Overview
Expiration days for Anyone links SHALL be set to 30 days or less.
Rationale: Anyone links that do not expire or have excessively long expiration periods pose a persistent risk of unauthorized access. Setting an expiration of 30 days or less ensures that shared content access is time-limited.
Remediation action:
- Sign in to the SharePoint admin center.
- Select Policies > Sharing.
- Under Advanced settings for Anyone links, check These links must expire within this many days and set to 30 days or less.
- Select Save.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CISA.MS.SHAREPOINT.3.1 |
| Severity | Medium |
| Suite | CISA |
| Product | SharePoint |
| Feature | Sharing links |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1048 Exfiltration Over Alternative Protocol, T1213.002 Sharepoint, T1530 Data from Cloud Storage |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.SHAREPOINT.3.1 |
| Criticality | SHALL |
| Upstream requirement | MS.SHAREPOINT.3.1v1 |
| Supports controls | cisa-scuba:MS.SHAREPOINT.3.1, nist-800-53-r5:AC-3, nist-800-53-r5:AC-21b |
| PowerShell test | Test-MtCisaSpoAnyoneLinkExpiration |
| Services | SharePointOnline |