Set the default sharing link permission to view

Description

The permission selected by default when a user creates a sharing link in SharePoint or OneDrive is View (DefaultLinkPermission = View). It applies to Specific people, organization and Anyone links. Users can still choose Can edit when they need it.

Rationale

Edit is the vendor default, so most links grant more than the user intends. An edit link lets every recipient alter or delete the file, replace it with a malicious version that colleagues trust, or reshare it if resharing is allowed. A view default applies least privilege without blocking collaboration.

Impact

Users who want co-authoring must switch the link to Can edit in the sharing dialog. Sites with their own default (Set-SPOSite -DefaultLinkPermission) keep it.

Setting

Audit

1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a Global Reader.
2. Browse to Policies > Sharing > File and folder links and check that the permission selected by default for sharing links is View.
3. With the SharePoint Online Management Shell (SharePoint Administrator): Get-SPOTenant | Select-Object DefaultLinkPermission must return View.
4. Fail if the default permission is Edit.

Remediation

1. In the SharePoint admin center, browse to Policies > Sharing > File and folder links, set the default permission to View and Save. Role: SharePoint Administrator.
2. PowerShell equivalent: Set-SPOTenant -DefaultLinkPermission View.

References

• Change the default link type for sharing Microsoft, vendor-doc, accessed 2026-10-24
• Manage sharing settings for SharePoint and OneDrive in Microsoft 365 Microsoft, vendor-doc, accessed 2026-10-24
• Set-SPOTenant (SharePoint Online Management Shell) Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft SharePoint Online and OneDrive baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-COLLAB-008 Set the default sharing link type to specific people

People and lifecycle