CISA.MS.SHAREPOINT.2.1: File and folder default sharing scope SHALL be set to Specific People.
| ID | CISA.MS.SHAREPOINT.2.1 |
| Severity | Medium |
| Suite | CISA SCuBA baselines |
| Product | SharePoint |
| Feature | Sharing links |
| Security area | Access control |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.SHAREPOINT.2.1 (SHALL) |
| Framework controls | cisa-scuba:MS.SHAREPOINT.2.1nist-800-53-r5:AC-6 Least Privilege |
| MITRE ATT&CK | T1048, T1213.002 |
| Reads from | SharePoint Online PowerShell |
What this checks and how to fix it
Section titled “What this checks and how to fix it”File and folder default sharing scope SHALL be set to Specific People (only the people the user specifies).
Rationale: Overly permissive default sharing settings increase the risk of unintentional data exposure. Setting the default to Specific People ensures users make deliberate sharing decisions.
Remediation action:
Section titled “Remediation action:”- Sign in to the SharePoint admin center.
- Select Policies > Sharing.
- Under File and folder links, set the default link type to Specific people (only the people the user specifies).
- Select Save.
Related links
Section titled “Related links”Mito check, based on CISA ScubaGear. Author: Mynster9361. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.