M365SPO-002: Guest access expiration
- Plataforma
- Entra ID / M365
- Categoría
- SharePoint & OneDrive Security
- Severidad
- Medium
- Pilar de Zero Trust
- Data (peso 1)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Guest access to SharePoint and OneDrive content without an expiration policy leads to perpetual external access that is rarely reviewed or revoked. Former partners, vendors, and collaborators may retain access to sensitive corporate content long after the business relationship has ended. Configuring automatic guest access expiration ensures that external sharing is time-limited and requires periodic re-authorization.
Valor recomendado
Guest access expiration set to 30-90 days; sharing links expire within 30 days
Remediación
Configure the guest access expiration policy in the SharePoint admin center to automatically expire guest permissions after 30 to 90 days based on organizational data sensitivity requirements. Set sharing link expiration to a maximum of 30 days for external sharing links to prevent long-lived access tokens. Implement a recurring guest access review process to audit active external sharing and remove access that is no longer needed.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- MS.SHAREPOINT.3.1v1
- NIST SP 800-53
- AC-2(3)
- CIS M365 Benchmark
- 7.2.3