CISA.MS.SHAREPOINT.2.2: File and folder default sharing permissions SHALL be set to View only.
| ID | CISA.MS.SHAREPOINT.2.2 |
| Severity | Medium |
| Suite | CISA SCuBA baselines |
| Product | SharePoint |
| Feature | Sharing links |
| Security area | Access control |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.SHAREPOINT.2.2 (SHALL) |
| Framework controls | cisa-scuba:MS.SHAREPOINT.2.2nist-800-53-r5:AC-6 Least Privilege |
| MITRE ATT&CK | T1080, T1565.001 |
| Reads from | SharePoint Online PowerShell |
What this checks and how to fix it
Section titled “What this checks and how to fix it”File and folder default sharing permissions SHALL be set to View only.
Rationale: Setting the default permission to View reduces the risk of accidental editing of shared documents by external parties.
Remediation action:
Section titled “Remediation action:”- Sign in to the SharePoint admin center.
- Select Policies > Sharing.
- Under File and folder links, set the default link permission to View.
- Select Save.
Related links
Section titled “Related links”Mito check, based on CISA ScubaGear. Author: Mynster9361. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.