CIS.M365.7.2.9: Ensure guest access to a site or OneDrive will expire automatically

Not run by Mito today

This check needs a connection to SharePoint Online PowerShell, which Mito’s assessment does not set up. Mito reports it as skipped.

CIS Benchmark notice

This check implements a recommendation of the CIS Microsoft 365 Foundations Benchmark. The benchmark text is © Center for Internet Security, Inc. and is not reproduced here beyond the short summary below. Get the full benchmark free of charge from cisecurity.org.

ID	CIS.M365.7.2.9
Severity	Medium
Suite	CIS Microsoft 365 Foundations Benchmark
Product	SharePoint
Feature	External sharing
Security area	External access and sharing
Resource type	Tenant
User impact of fixing	Medium
Effort to fix	Low
Benchmark	CIS Microsoft 365 Foundations Benchmark 7.0.0, 7.2.9 (L1, E3 Level 1, E5 Level 1)
Framework controls	cis-m365:7.2.9 nist-800-53-r5:AC-2(2) Account Management | Automated Temporary and Emergency Account Management
MITRE ATT&CK	T1213.002, T1530
Reads from	SharePoint Online PowerShell

What this checks and how to fix it

7.2.9 (L1) Ensure guest access to a site or OneDrive will expire automatically

This policy setting configures the expiration time for each guest that is invited to the SharePoint site or with whom users share individual files and folders with.

The recommended state is 30. This is the minimum value SharePoint allows for this setting.

Rationale

This setting ensures that guests who no longer need access to the site or link no longer have access after a set period of time. Allowing guest access for an indefinite amount of time could lead to loss of data confidentiality and oversight.

Note: Guest membership applies at the Microsoft 365 group level. Guests who have permission to view a SharePoint site or use a sharing link may also have access to a Microsoft Teams team or security group.

Impact

Site collection administrators will have to renew access to guests who still need access after 30 days. They will receive an e-mail notification once per week about guest access that is about to expire.

Note: The guest expiration policy only applies to guests who use sharing links or guests who have direct permissions to a SharePoint site after the guest policy is enabled. The guest policy does not apply to guest users that have pre-existing permissions or access through a sharing link before the guest expiration policy is applied.

Remediation

1. Navigate to SharePoint admin center
2. Click to expand Policies > Sharing.
3. Scroll to and expand More external sharing settings.
4. Set Guest access to a site or OneDrive will expire automatically after this many days to 30

PowerShell

1. Connect to SharePoint Online using Connect-SPOService
2. Run the following command:

Set-SPOTenant -ExternalUserExpireInDays 30 -ExternalUserExpirationRequired $True

Default Value: ExternalUserExpirationRequired $false, ExternalUserExpireInDays 60 days

Related Links

• Manage sharing settings for SharePoint and OneDrive in Microsoft 365
• Managing SharePoint Online Security: A Team Effort
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 487

---

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: Mynster9361. Open-source licences.