CISA.MS.SHAREPOINT.3.1: Expiration days for Anyone links SHALL be set to 30 days or less.
| ID | CISA.MS.SHAREPOINT.3.1 |
| Severity | Medium |
| Suite | CISA SCuBA baselines |
| Product | SharePoint |
| Feature | Sharing links |
| Security area | External access and sharing |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.SHAREPOINT.3.1 (SHALL) |
| Framework controls | cisa-scuba:MS.SHAREPOINT.3.1nist-800-53-r5:AC-3 Access Enforcementnist-800-53-r5:AC-21b Information Sharing |
| MITRE ATT&CK | T1048, T1213.002, T1530 |
| Reads from | SharePoint Online PowerShell |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Expiration days for Anyone links SHALL be set to 30 days or less.
Rationale: Anyone links that do not expire or have excessively long expiration periods pose a persistent risk of unauthorized access. Setting an expiration of 30 days or less ensures that shared content access is time-limited.
Remediation action:
Section titled “Remediation action:”- Sign in to the SharePoint admin center.
- Select Policies > Sharing.
- Under Advanced settings for Anyone links, check These links must expire within this many days and set to 30 days or less.
- Select Save.
Related links
Section titled “Related links”Mito check, based on CISA ScubaGear. Author: Mynster9361. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.