What it decides

Rule
SPO-SHARE-003
Applies to
sharepoint · tenant
Default severity
medium
Basis
documented-guidance

On what authority

Microsoft states the risk and the mitigation in the same paragraph: "While this can be convenient for users, it can increase the risk of unintentional unauthenticated sharing. If a user forgets to change the link type while sharing a sensitive document, they might accidentally create a sharing link that doesn't require authentication. You can mitigate this risk by changing the default link setting to a link that only works for people inside your organization." Guidance and not a requirement: the product permits the alternative, the page describes how to choose it, and an organisation whose work is genuinely public may reasonably keep it.

What it needs to decide

  • tenant_sharing.capability
  • tenant_sharing.default_link_type

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

  • tenant-sharing: what the organisation permits, which every site inherits by default · live-validated

What a pass does not establish

A safe organisation default says nothing about individual sites. A site that overrides it with the Anyone link passes this rule and fails SPO-SHARE-002, and the two are meant to be read together.

  • The default applies to the modern experience. Microsoft states it does not affect Outlook on the web, Outlook 2016 or Office clients before 2016, so sharing through those paths is outside what this rule describes.
  • This reads the setting, not behaviour. People who select the Anyone link every time produce the same result whether the default is safe or not.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b6@b4bf9c325233.

Generated from capability-manifest/1.0.0 at1.0.0b6@b4bf9c325233, contract1.0.0b6. Every fact on this page is the Engine's; this site publishes it and does not maintain it.