CreativeTechsBaseline
tenant security posture
CTB-21 · Tier 3 · Negotiated · M365 / GWS

External sharing limited to authenticated recipients

Microsoft 10 ptsCISA SCuBA MS.SHAREPOINT.1.1–2.2CIS M365 7.2.7 / 7.2.11 · L1Huntress 5 sharing controls · Medium · Foundational4 authorities
17
Tenants failing
2
Tenants meeting
22
Measured
REQUIRED
Disposition
The settingWhat we hold this to
CreativeTechs minimum
SharePoint and OneDrive external sharing = 'New and existing guests' (not Anyone). Default sharing link type = Specific people. Default link permission = View. Anonymous link expiry ≤ 30 days where Anyone links remain enabled under a recorded exception.
Benchmark position
CIS M365 7.2.7 (L1) — default link type 'Specific people' or 'Only people in your organization'. CIS M365 7.2.11 (L1) — default sharing link permission 'View'. CISA MS.SHAREPOINT.1.1–1.2 — external sharing limited to existing guests. Our minimum matches all of these.
Where we differ, and why
CISA 1.3 goes further and restricts sharing to approved external domains; we do not hold clients to a domain allowlist because agency work is genuinely open-ended. Where a client will accept one, record it as a tightening, not an exception.
Where the switch is
SharePoint admin centre → Policies → Sharing → External sharing slider, then 'File and folder links' for default type and permission and link expiry.
https://<tenant>-admin.sharepoint.com
How to verify
Get-SPOTenant | fl SharingCapability,DefaultSharingLinkType,DefaultLinkPermission,RequireAnonymousLinksExpireInDays
Across the fleet
Client
State
Evidence
Blackwing
NOT MET
2 of 2 score controls at zero.
BravicaOne
NOT MET
2 of 2 score controls at zero.
CMG Law
NOT MET
2 of 2 score controls at zero.
CreativeTechs
MET
2 of 2 score controls complete.
DCG One
MET
2 of 2 score controls complete.
Diversified Management Services
NOT MET
2 of 2 score controls at zero.
Double Z
NOT MET
2 of 2 score controls at zero.
Electric Pen
NOT MET
2 of 2 score controls at zero.
Graphiti Associates
DEPLOYING
1 complete, 0 partial, 1 at zero.
Guidance Engineering
NOT MET
2 of 2 score controls at zero.
India Tree
NOT MET
2 of 2 score controls at zero.
MIR Corp
NOT MET
2 of 2 score controls at zero.
Phinney Bischoff
NOT MET
2 of 2 score controls at zero.
Quiver Dental
UNKNOWN
Not scored in this tenant.
RHO Architects
NOT MET
2 of 2 score controls at zero.
Retail Voodoo
NOT MET
2 of 2 score controls at zero.
Riverstone
DEPLOYING
1 complete, 0 partial, 1 at zero.
SSF
NOT MET
2 of 2 score controls at zero.
Slingshot Architecture
NOT MET
2 of 2 score controls at zero.
Stoke
UNKNOWN
Not scored in this tenant.
Turnstyle
DEPLOYING
1 complete, 0 partial, 1 at zero.
Urban Animal
NOT MET
2 of 2 score controls at zero.
WLIHA
NOT MET
2 of 2 score controls at zero.
Zak Designs
NOT MET
2 of 2 score controls at zero.
Why it matters
“Anyone with the link” is a public URL that works indefinitely, forwards freely and can be indexed.
How we check
Secure Score exo_individualsharing and exo_storageproviderrestricted. CIS.M365.7.2.7 / 7.2.11 · L1, CISA.MS.SHAREPOINT.1.1–2.2.
Fix — M365
SharePoint admin → Sharing → New and existing guests, not Anyone. Set link expiry and default link type to specific people.
Fix — Google
Admin → Drive → Sharing → restrict to the organization or allowlisted domains; turn off “anyone with the link”.
User notices
Depends entirely on how you flip it — existing anonymous links may keep working or may break. Audit them first.
Expected pushback
This is the fight. Creative agencies live on sending a link to a client. Realistic middle: permit guest links with an expiry, kill “anyone”, and provide a sanctioned large-file path so people don't route around it.