CISA.MS.SHAREPOINT.3.2 - Allowable file and folder permissions for Anyone links SHALL be set to View only.
Overview
Allowable file and folder permissions for Anyone links SHALL be set to View only.
Rationale: Allowing edit permissions on Anyone links increases the risk of unauthorized modifications to shared content. Restricting to View only limits the potential impact of anonymous access.
Remediation action:
- Sign in to the SharePoint admin center.
- Select Policies > Sharing.
- Under Advanced settings for Anyone links, set the file and folder permissions to View.
- Select Save.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CISA.MS.SHAREPOINT.3.2 |
| Severity | Medium |
| Suite | CISA |
| Product | SharePoint |
| Feature | Sharing links |
| Area | External access and sharing |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1080 Taint Shared Content, T1565.001 Stored Data Manipulation |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.SHAREPOINT.3.2 |
| Criticality | SHALL |
| Upstream requirement | MS.SHAREPOINT.3.2v1 |
| Supports controls | cisa-scuba:MS.SHAREPOINT.3.2, nist-800-53-r5:AC-6 |
| PowerShell test | Test-MtCisaSpoAnyoneLinkPermission |
| Services | SharePointOnline |