{
  "id": "CB-M365-COLLAB-012",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-012",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-012.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-COLLAB-012.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-COLLAB-012",
    "title": "Require people who use a verification code to reauthenticate regularly",
    "finding": {
      "title": "External recipients who sign in with a verification code stay signed in indefinitely",
      "description": "A browser session opened with an emailed code keeps access to shared content without ever proving again that its holder controls the mailbox."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "external-sharing",
      "guest-access",
      "session",
      "sharepoint",
      "onedrive"
    ],
    "description": "External recipients who authenticate with a one-time verification code sent by email and choose to\nstay signed in must prove again that they control the mailbox every\n`{{ verification_code_reauth_days }}` days (`EmailAttestationRequired` = `True`,\n`EmailAttestationReAuthDays`).\n\nThis SharePoint setting applies to recipients authenticated by SharePoint itself. When Microsoft\nEntra B2B integration is on (CB-M365-COLLAB-002), guests use the Entra B2B email one-time passcode\ninstead and the Entra session controls apply.\n",
    "rationale": "A verification code proves control of a mailbox once. Without reauthentication, a session cookie\nopened on a shared or lost computer, or a mailbox that the person no longer controls (left the\ncompany, recycled address), keeps access to the shared files for as long as the cookie lives. A\nshort reauthentication period bounds that window.\n",
    "impact": "External recipients using verification codes receive a new code by email every\n`{{ verification_code_reauth_days }}` days. Microsoft retires SharePoint one-time passcode\nauthentication for commercial tenants in October 2026; after that, the setting only matters for\ntenants where it still applies, and the reauthentication of B2B guests depends on Entra Conditional\nAccess session controls.\n",
    "setting": {
      "location": "SharePoint admin center > Policies > Sharing > More external sharing settings > People who use a verification code must reauthenticate after this many days",
      "default_value": "Off (EmailAttestationRequired = False)",
      "recommended_value": "On, {{ verification_code_reauth_days }} days or less"
    },
    "parameters": [
      {
        "name": "verification_code_reauth_days",
        "type": "integer",
        "description": "Maximum number of days before a verification-code user must reauthenticate.",
        "unit": "days",
        "default": 15,
        "minimum": 1,
        "maximum": 365
      }
    ],
    "audit": {
      "manual": "1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a\n   Global Reader.\n2. Browse to **Policies** > **Sharing** > **More external sharing settings** and check that **People\n   who use a verification code must reauthenticate after this many days** is selected with at most\n   `{{ verification_code_reauth_days }}`.\n3. With the SharePoint Online Management Shell (SharePoint Administrator):\n   `Get-SPOTenant | Select-Object EmailAttestationRequired, EmailAttestationReAuthDays`.\n4. Fail if external sharing is allowed and `EmailAttestationRequired` is `False` or\n   `EmailAttestationReAuthDays` is greater than `{{ verification_code_reauth_days }}`.\n"
    },
    "remediation": {
      "manual": "1. In the SharePoint admin center, browse to **Policies** > **Sharing** > **More external sharing\n   settings**, select **People who use a verification code must reauthenticate after this many\n   days**, enter `{{ verification_code_reauth_days }}` and **Save**. Role: SharePoint Administrator.\n2. PowerShell equivalent:\n   `Set-SPOTenant -EmailAttestationRequired $true -EmailAttestationReAuthDays {{ verification_code_reauth_days }}`.\n3. For B2B guests, bound the session with a Conditional Access policy targeting **Guest or external\n   users** with **Sign-in frequency** set to the same number of days.\n"
    },
    "references": [
      {
        "title": "Manage sharing settings for SharePoint and OneDrive in Microsoft 365",
        "url": "https://learn.microsoft.com/sharepoint/turn-external-sharing-on-or-off",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Secure external sharing recipient experience",
        "url": "https://learn.microsoft.com/sharepoint/what-s-new-in-sharing-in-targeted-release",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Set-SPOTenant (SharePoint Online Management Shell)",
        "url": "https://learn.microsoft.com/powershell/module/microsoft.online.sharepoint.powershell/set-spotenant",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft SharePoint Online and OneDrive baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/sharepoint.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.SHAREPOINT.3.3v2",
        "relation": "stricter",
        "note": "SCuBA allows up to 30 days; this control uses 15 days by default."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-11",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-12",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1539"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-COLLAB-002",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-012",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}