# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-COLLAB-012
title: Require people who use a verification code to reauthenticate regularly
finding:
  title: External recipients who sign in with a verification code stay signed in indefinitely
  description: A browser session opened with an emailed code keeps access to shared content without ever proving again that its holder controls the mailbox.
status: active
profiles: [baseline]
risk:
  severity: medium
assessment: manual
tags: [external-sharing, guest-access, session, sharepoint, onedrive]

description: |
  External recipients who authenticate with a one-time verification code sent by email and choose to
  stay signed in must prove again that they control the mailbox every
  `{{ verification_code_reauth_days }}` days (`EmailAttestationRequired` = `True`,
  `EmailAttestationReAuthDays`).

  This SharePoint setting applies to recipients authenticated by SharePoint itself. When Microsoft
  Entra B2B integration is on (CB-M365-COLLAB-002), guests use the Entra B2B email one-time passcode
  instead and the Entra session controls apply.
rationale: |
  A verification code proves control of a mailbox once. Without reauthentication, a session cookie
  opened on a shared or lost computer, or a mailbox that the person no longer controls (left the
  company, recycled address), keeps access to the shared files for as long as the cookie lives. A
  short reauthentication period bounds that window.
impact: |
  External recipients using verification codes receive a new code by email every
  `{{ verification_code_reauth_days }}` days. Microsoft retires SharePoint one-time passcode
  authentication for commercial tenants in October 2026; after that, the setting only matters for
  tenants where it still applies, and the reauthentication of B2B guests depends on Entra Conditional
  Access session controls.

setting:
  location: SharePoint admin center > Policies > Sharing > More external sharing settings > People who use a verification code must reauthenticate after this many days
  default_value: Off (EmailAttestationRequired = False)
  recommended_value: "On, {{ verification_code_reauth_days }} days or less"
parameters:
  - name: verification_code_reauth_days
    type: integer
    description: Maximum number of days before a verification-code user must reauthenticate.
    unit: days
    default: 15
    minimum: 1
    maximum: 365

audit:
  manual: |
    1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a
       Global Reader.
    2. Browse to **Policies** > **Sharing** > **More external sharing settings** and check that **People
       who use a verification code must reauthenticate after this many days** is selected with at most
       `{{ verification_code_reauth_days }}`.
    3. With the SharePoint Online Management Shell (SharePoint Administrator):
       `Get-SPOTenant | Select-Object EmailAttestationRequired, EmailAttestationReAuthDays`.
    4. Fail if external sharing is allowed and `EmailAttestationRequired` is `False` or
       `EmailAttestationReAuthDays` is greater than `{{ verification_code_reauth_days }}`.

remediation:
  manual: |
    1. In the SharePoint admin center, browse to **Policies** > **Sharing** > **More external sharing
       settings**, select **People who use a verification code must reauthenticate after this many
       days**, enter `{{ verification_code_reauth_days }}` and **Save**. Role: SharePoint Administrator.
    2. PowerShell equivalent:
       `Set-SPOTenant -EmailAttestationRequired $true -EmailAttestationReAuthDays {{ verification_code_reauth_days }}`.
    3. For B2B guests, bound the session with a Conditional Access policy targeting **Guest or external
       users** with **Sign-in frequency** set to the same number of days.

references:
  - title: Manage sharing settings for SharePoint and OneDrive in Microsoft 365
    url: https://learn.microsoft.com/sharepoint/turn-external-sharing-on-or-off
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Secure external sharing recipient experience
    url: https://learn.microsoft.com/sharepoint/what-s-new-in-sharing-in-targeted-release
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Set-SPOTenant (SharePoint Online Management Shell)
    url: https://learn.microsoft.com/powershell/module/microsoft.online.sharepoint.powershell/set-spotenant
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: CISA SCuBA Microsoft SharePoint Online and OneDrive baseline
    url: https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/sharepoint.md
    publisher: CISA
    kind: standard
    accessed: 2026-10-24
mappings:
  - framework: cis-m365
    framework_version: "7.0.0"
    id: "7.2.10"
    relation: equivalent
  - framework: cisa-scuba-m365
    framework_version: "2.0.0"
    id: MS.SHAREPOINT.3.3v2
    relation: stricter
    note: SCuBA allows up to 30 days; this control uses 15 days by default.
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: IA-11
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-12
    relation: related
threats:
  - framework: mitre-attack
    id: T1539
related_controls:
  - id: CB-M365-COLLAB-002
    type: related
  - id: CB-M365-AUTH-012
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24