Detections
Analytics
7.2.7 Ensure link sharing is restricted in SharePoint and OneDrive
Information
This setting sets the default link type that a user will see when sharing content in OneDrive or SharePoint. It does not restrict or exclude any other options.The recommended state is Specific people (only the people the user specifies) or Only people in your organization.
By defaulting to specific people, the user will first need to consider whether or not the content being shared should be accessible by the entire organization versus select individuals. This aids in reinforcing the concept of least privilege.
Solution
To remediate using the UI:- Navigate to SharePoint admin center https://admin.microsoft.com/sharepoint
- Expand Policies > Sharing.
- Scroll to File and folder links.
- Set Choose the type of link that's selected by default when users share files and folders in SharePoint and OneDrive to Specific people (only the people the user specifies) or Only people in your organization.
To remediate using PowerShell:
- Connect to SharePoint Online using Connect-SPOService.
- Run one of the following PowerShell commands depending on the desired compliant state:
To set the default sharing link to specific people:
Set-SPOTenant -DefaultSharingLinkType Direct
To set the default sharing link to people in the organization:
Set-SPOTenant -DefaultSharingLinkType Internal
Impact:
Changing the default sharing link type influences the user experience when sharing files and folders in SharePoint and OneDrive. The configured default option will appear pre-selected in the sharing dialog, guiding users toward the organization's preferred sharing method.
See Also
Item Details
Audit Name: CIS Microsoft 365 Foundations v7.0.0 L1 E3
Category: ACCESS CONTROL, MEDIA PROTECTION
References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2
Plugin: microsoft_azure
Control ID: a208a9dbb25ebed8835c731202f77aec00a1b819ada65738de5d5489ecf8da65