{
  "id": "CB-M365-COLLAB-009",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-009",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-009.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-009.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-009",
    "title": "Set the default sharing link permission to view",
    "finding": {
      "title": "Sharing links grant edit permission by default",
      "description": "Recipients of a default link can change or delete the shared content, including when the link was meant for reading."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "sharing-links",
      "sharepoint",
      "onedrive",
      "least-privilege"
    ],
    "description": "The permission selected by default when a user creates a sharing link in SharePoint or OneDrive is\n**View** (`DefaultLinkPermission` = `View`). It applies to **Specific people**, organization and\n**Anyone** links. Users can still choose **Can edit** when they need it.\n",
    "rationale": "Edit is the vendor default, so most links grant more than the user intends. An edit link lets every\nrecipient alter or delete the file, replace it with a malicious version that colleagues trust, or\nreshare it if resharing is allowed. A view default applies least privilege without blocking\ncollaboration.\n",
    "impact": "Users who want co-authoring must switch the link to **Can edit** in the sharing dialog. Sites with\ntheir own default (`Set-SPOSite -DefaultLinkPermission`) keep it.\n",
    "setting": {
      "location": "SharePoint admin center > Policies > Sharing > File and folder links > Choose the permission that's selected by default for sharing links",
      "default_value": "Edit",
      "recommended_value": "View (DefaultLinkPermission = View)"
    },
    "audit": {
      "manual": "1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a\n   Global Reader.\n2. Browse to **Policies** > **Sharing** > **File and folder links** and check that the permission\n   selected by default for sharing links is **View**.\n3. With the SharePoint Online Management Shell (SharePoint Administrator):\n   `Get-SPOTenant | Select-Object DefaultLinkPermission` must return `View`.\n4. Fail if the default permission is `Edit`.\n"
    },
    "remediation": {
      "manual": "1. In the SharePoint admin center, browse to **Policies** > **Sharing** > **File and folder links**,\n   set the default permission to **View** and **Save**. Role: SharePoint Administrator.\n2. PowerShell equivalent: `Set-SPOTenant -DefaultLinkPermission View`.\n"
    },
    "references": [
      {
        "title": "Change the default link type for sharing",
        "url": "https://learn.microsoft.com/sharepoint/change-default-sharing-link",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Manage sharing settings for SharePoint and OneDrive in Microsoft 365",
        "url": "https://learn.microsoft.com/sharepoint/turn-external-sharing-on-or-off",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-SPOTenant (SharePoint Online Management Shell)",
        "url": "https://learn.microsoft.com/powershell/module/microsoft.online.sharepoint.powershell/set-spotenant",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft SharePoint Online and OneDrive baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/sharepoint.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.SHAREPOINT.2.2v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-3",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1565.001"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-COLLAB-008",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}