What it decides

Rule
SPO-SHARE-001
Applies to
sharepoint · site
Default severity
medium
Basis
convention

On what authority

Microsoft permits this setting, offers it as one of four, and describes it as "best for friction-free sharing if most files and folders in SharePoint and OneDrive aren't sensitive". It also states plainly that "people using an Anyone link don't have to authenticate, and their access can't be audited". Both sentences are Microsoft's; the judgement that a site in this state belongs on a list somebody reads is ours. The sources explain the claim and do not make it a requirement.

What it needs to decide

  • sharing.capability

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

  • sharing: what one site permits, and its default link · live-validated

What a pass does not establish

A site with Anyone links turned off today may hold documents shared that way last year, and those links keep working. Turning the setting off does not revoke what it produced, and this rule reads only the setting.

  • The rule does not count links. A site permitting Anyone links and using none is indistinguishable here from one where every document has one.
  • SharePoint enforces that a site cannot be more permissive than the tenant, so a site in this state is a tenant that permits it. Whether that was decided or inherited is not visible from here.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b6@b4bf9c325233.

Generated from capability-manifest/1.0.0 at1.0.0b6@b4bf9c325233, contract1.0.0b6. Every fact on this page is the Engine's; this site publishes it and does not maintain it.