cirsec Baselines
Esc
Microsoft 365 tenant · SharePoint, OneDrive & Teams

Expire guest access to sites and OneDrive automatically

When it fails: Guest access to SharePoint sites and OneDrive never expires. Guests keep access to shared sites and files long after the collaboration ended, unless someone remembers to remove them.

CB-M365-COLLAB-011mediumactivemanualprofile baseline

Description

Guest access to a SharePoint site or a OneDrive expires automatically after {{ guest_access_expiration_days }} days (ExternalUserExpirationRequired = True, ExternalUserExpireInDays). The expiry is set when the guest joins the site, through a sharing link or direct access; site owners can extend it for a guest who still needs access.

Rationale

Guest access is rarely removed when a project ends. Stale guest permissions are a standing exposure: the external account may be compromised, its owner may have changed employer, and nobody reviews it. An automatic expiry makes access time-bound by default and forces a conscious renewal.

Impact

Guests lose access to the site or OneDrive after the period unless an owner extends it from the site permissions page (Manage guest expiration). Expiry values are set as guests join: guests already present before the policy are not covered until they join again. The guest account itself stays in Entra; remove inactive guests with access reviews (CB-M365-TENANT-013).

Setting

LocationSharePoint admin center > Policies > Sharing > More external sharing settings > Guest access to a site or OneDrive will expire automatically after this many days
DefaultOff (ExternalUserExpirationRequired = False)
RecommendedOn, {{ guest_access_expiration_days }} days or less

Parameters

ParameterBaselineHardenedBounds
guest_access_expiration_daysinteger, days. Days after which a guest's access to a site or OneDrive expires (SharePoint accepts 30 to 730).303030 to 730

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

  1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a Global Reader.
  2. Browse to Policies > Sharing > More external sharing settings and check that Guest access to a site or OneDrive will expire automatically after this many days is selected with at most {{ guest_access_expiration_days }}.
  3. With the SharePoint Online Management Shell (SharePoint Administrator): Get-SPOTenant | Select-Object ExternalUserExpirationRequired, ExternalUserExpireInDays.
  4. Fail if external sharing is allowed and ExternalUserExpirationRequired is False or ExternalUserExpireInDays is greater than {{ guest_access_expiration_days }}.

Remediation

  1. Tell site owners that guests will expire and how to extend them.
  2. In the SharePoint admin center, browse to Policies > Sharing > More external sharing settings, select Guest access to a site or OneDrive will expire automatically after this many days, enter {{ guest_access_expiration_days }} and Save. Role: SharePoint Administrator.
  3. PowerShell equivalent: Set-SPOTenant -ExternalUserExpirationRequired $true -ExternalUserExpireInDays {{ guest_access_expiration_days }}.

Rollback

Run Set-SPOTenant -ExternalUserExpirationRequired $false. Expiry dates already set on guests are not cleared automatically; owners can extend them.

References

Mappings

FrameworkIDRelation
NIST SP 800-53 Rev. 55.1.1AC-2(3)related
NIST SP 800-53 Rev. 55.1.1AC-2related

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1078.004

People and lifecycle

Authors
Introduced inv0.1.0
Created, updated2026-10-24, 2026-10-24
Translationsfr