CISA.MS.SHAREPOINT.3.2: Allowable file and folder permissions for Anyone links SHALL be set to View only.
| ID | CISA.MS.SHAREPOINT.3.2 |
| Severity | Medium |
| Suite | CISA SCuBA baselines |
| Product | SharePoint |
| Feature | Sharing links |
| Security area | External access and sharing |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.SHAREPOINT.3.2 (SHALL) |
| Framework controls | cisa-scuba:MS.SHAREPOINT.3.2nist-800-53-r5:AC-6 Least Privilege |
| MITRE ATT&CK | T1080, T1565.001 |
| Reads from | SharePoint Online PowerShell |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Allowable file and folder permissions for Anyone links SHALL be set to View only.
Rationale: Allowing edit permissions on Anyone links increases the risk of unauthorized modifications to shared content. Restricting to View only limits the potential impact of anonymous access.
Remediation action:
Section titled “Remediation action:”- Sign in to the SharePoint admin center.
- Select Policies > Sharing.
- Under Advanced settings for Anyone links, set the file and folder permissions to View.
- Select Save.
Related links
Section titled “Related links”Mito check, based on CISA ScubaGear. Author: Mynster9361. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.