CIS.M365.7.2.7: Ensure link sharing is restricted in SharePoint and OneDrive

Not run by Mito today

This check needs a connection to SharePoint Online PowerShell, which Mito’s assessment does not set up. Mito reports it as skipped.

CIS Benchmark notice

This check implements a recommendation of the CIS Microsoft 365 Foundations Benchmark. The benchmark text is © Center for Internet Security, Inc. and is not reproduced here beyond the short summary below. Get the full benchmark free of charge from cisecurity.org.

ID	CIS.M365.7.2.7
Severity	Medium
Suite	CIS Microsoft 365 Foundations Benchmark
Product	SharePoint
Feature	Sharing links
Security area	Access control
Resource type	Tenant
User impact of fixing	Low
Effort to fix	Low
Benchmark	CIS Microsoft 365 Foundations Benchmark 7.0.0, 7.2.7 (L1, E3 Level 1, E5 Level 1)
Framework controls	cis-m365:7.2.7 nist-800-53-r5:AC-3 Access Enforcement nist-800-53-r5:AC-6 Least Privilege
MITRE ATT&CK	T1213.002
Reads from	SharePoint Online PowerShell

What this checks and how to fix it

7.2.7 (L1) Ensure link sharing is restricted in SharePoint and OneDrive

This setting sets the default link type that a user will see when sharing content in OneDrive or SharePoint. It does not restrict or exclude any other options. The recommended state is Specific people (only the people the user specifies) or Only people in your organization (more restrictive).

Rationale

By defaulting to specific people, the user will first need to consider whether or not the content being shared should be accessible by the entire organization versus select individuals. This aids in reinforcing the concept of least privilege.

Impact

Changing the default sharing link type influences the user experience when sharing files and folders in SharePoint and OneDrive. The configured default option will appear pre-selected in the sharing dialog, guiding users toward the organization’s preferred sharing method.

Remediation

1. Navigate to SharePoint admin center
2. Click to expand Policies > Sharing.
3. Scroll to File and folder links.
4. Set Choose the type of link that’s selected by default when users share files and folders in SharePoint and OneDrive to Specific people (only the people the user specifies) or Only people in your organization.

PowerShell

1. Connect to SharePoint Online using Connect-SPOService
2. Run the following command:

Set-SPOTenant -DefaultSharingLinkType Direct

1. Or, to set a more restrictive state:

Set-SPOTenant -DefaultSharingLinkType Internal

Default Value: Only people in your organization (Internal)

Related Links

• Set-SPOTenant
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 480

---

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: Mynster9361. Open-source licences.