What it decides

Rule
SPO-SHARE-005
Applies to
sharepoint · site
Default severity
medium
Basis
convention

On what authority

Microsoft lists "choose if the default sharing link allows recipients to edit the files" among the options for "reducing the risk of oversharing", and its guidance on default link types notes that the defaults "provide a safe baseline" precisely because "typically, users don't change the settings before sharing". The product permits the edit default and documents how to set it, so preferring view is our convention: a default is exercised by the people who are not thinking about it, and the reversible reading beats the writable one for that population.

What it needs to decide

  • sharing.default_link_permission

Without these facts the rule answers unknown, which is not a pass and is not a failure: it is the rule saying the evidence could not settle the question.

Where the evidence comes from

  • sharing: what one site permits, and its default link · live-validated

What a pass does not establish

A view default stops nobody from choosing edit on purpose. Somebody who selects edit on every share produces the same links on a site that passes this rule as on one that fails it, and the rule reads only the default.

  • A site that follows the tenant is not-applicable here, and the tenant's own default permission is not gathered by this collection. At the tenant level, only the anonymous-link permission has a rule (SPO-SHARE-004), because it is the one Microsoft's guidance names.
  • The default applies to libraries using the modern experience, the same boundary Microsoft documents for the default link type, so sharing done through older clients is outside what this rule describes.

Source

The rule as the Engine holds it, at the revision this page was generated from: 1.0.0b6@b4bf9c325233.

Generated from capability-manifest/1.0.0 at1.0.0b6@b4bf9c325233, contract1.0.0b6. Every fact on this page is the Engine's; this site publishes it and does not maintain it.