{
  "id": "CB-M365-COLLAB-011",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-011",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-011.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-011.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-011",
    "title": "Expire guest access to sites and OneDrive automatically",
    "finding": {
      "title": "Guest access to SharePoint sites and OneDrive never expires",
      "description": "Guests keep access to shared sites and files long after the collaboration ended, unless someone remembers to remove them."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "guest-access",
      "external-sharing",
      "sharepoint",
      "onedrive",
      "lifecycle"
    ],
    "description": "Guest access to a SharePoint site or a OneDrive expires automatically after\n`{{ guest_access_expiration_days }}` days (`ExternalUserExpirationRequired` = `True`,\n`ExternalUserExpireInDays`). The expiry is set when the guest joins the site, through a sharing link\nor direct access; site owners can extend it for a guest who still needs access.\n",
    "rationale": "Guest access is rarely removed when a project ends. Stale guest permissions are a standing exposure:\nthe external account may be compromised, its owner may have changed employer, and nobody reviews it.\nAn automatic expiry makes access time-bound by default and forces a conscious renewal.\n",
    "impact": "Guests lose access to the site or OneDrive after the period unless an owner extends it from the site\npermissions page (**Manage guest expiration**). Expiry values are set as guests join: guests already\npresent before the policy are not covered until they join again. The guest account itself stays in\nEntra; remove inactive guests with access reviews (CB-M365-TENANT-013).\n",
    "setting": {
      "location": "SharePoint admin center > Policies > Sharing > More external sharing settings > Guest access to a site or OneDrive will expire automatically after this many days",
      "default_value": "Off (ExternalUserExpirationRequired = False)",
      "recommended_value": "On, {{ guest_access_expiration_days }} days or less"
    },
    "parameters": [
      {
        "name": "guest_access_expiration_days",
        "type": "integer",
        "description": "Days after which a guest's access to a site or OneDrive expires (SharePoint accepts 30 to 730).",
        "unit": "days",
        "default": 30,
        "minimum": 30,
        "maximum": 730
      }
    ],
    "audit": {
      "manual": "1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a\n   Global Reader.\n2. Browse to **Policies** > **Sharing** > **More external sharing settings** and check that **Guest\n   access to a site or OneDrive will expire automatically after this many days** is selected with at\n   most `{{ guest_access_expiration_days }}`.\n3. With the SharePoint Online Management Shell (SharePoint Administrator):\n   `Get-SPOTenant | Select-Object ExternalUserExpirationRequired, ExternalUserExpireInDays`.\n4. Fail if external sharing is allowed and `ExternalUserExpirationRequired` is `False` or\n   `ExternalUserExpireInDays` is greater than `{{ guest_access_expiration_days }}`.\n"
    },
    "remediation": {
      "manual": "1. Tell site owners that guests will expire and how to extend them.\n2. In the SharePoint admin center, browse to **Policies** > **Sharing** > **More external sharing\n   settings**, select **Guest access to a site or OneDrive will expire automatically after this many\n   days**, enter `{{ guest_access_expiration_days }}` and **Save**. Role: SharePoint Administrator.\n3. PowerShell equivalent:\n   `Set-SPOTenant -ExternalUserExpirationRequired $true -ExternalUserExpireInDays {{ guest_access_expiration_days }}`.\n",
      "rollback": "Run `Set-SPOTenant -ExternalUserExpirationRequired $false`. Expiry dates already set on guests are\nnot cleared automatically; owners can extend them.\n"
    },
    "references": [
      {
        "title": "Manage sharing settings for SharePoint and OneDrive in Microsoft 365",
        "url": "https://learn.microsoft.com/sharepoint/turn-external-sharing-on-or-off",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-SPOTenant (SharePoint Online Management Shell)",
        "url": "https://learn.microsoft.com/powershell/module/microsoft.online.sharepoint.powershell/set-spotenant",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Manage guest expiration for a site",
        "url": "https://support.microsoft.com/office/manage-guest-expiration-for-a-site-25bee24f-42ad-4ee8-8402-4186eed74dea",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2(3)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-COLLAB-002",
        "type": "related"
      },
      {
        "id": "CB-M365-COLLAB-003",
        "type": "related"
      },
      {
        "id": "CB-M365-TENANT-013",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}