Skip to content

Make 'Specific people, view' the default sharing link and put an expiry on Anyone links

Control
CR03
Kit
Copilot readiness
Area
Safer sharing defaults
Priority
High
Effort
1 h
Last reviewed

Licence and role

Any SharePoint Online plan. SharePoint Administrator role.

Why it matters

Every 'People in your organisation' link created today is something Copilot can surface to the whole company tomorrow. Microsoft's guardrail step is to restrict company-wide and Anyone links at tenant level so new sharing is narrow by default.

Steps

  1. SharePoint admin center > Policies > Sharing: set 'File and folder links' default to 'Specific people (only the people the user specifies)' and the default permission to View.
  2. Same page: if Anyone links stay allowed, set them to expire (for example 30 days) and limit them to View. If nobody needs them, lower the external sharing level for SharePoint and OneDrive to 'New and existing guests'.
  3. For sites that must keep a different default, set it per site: Active sites > site > Sharing > Default sharing link type.
  4. Tell users in one short message: links now default to specific people; ask IT if you need a wider link.

Impact on users

Changes only new links. Existing links keep working until they expire or are removed (CR01 finds them). Some users will need one extra click to share wider.

Rollback

Set the defaults back on the same Sharing page. Changing the default affects new links only.

Read-only check

Reads settings only. It changes nothing in your tenant or on the device.

Modules, connection and role 
Requires: Microsoft.Online.SharePoint.PowerShell (SharePoint settings), ExchangeOnlineManagement (audit).
Connect first:
Connect-SPOService -Url https://<tenant>-admin.sharepoint.com
Connect-ExchangeOnline
Note: Microsoft retires Search-UnifiedAuditLog on 15 Oct 2027 (MC1505599). CR05 will move to the Graph AuditLogQuery API before then.

Get-SPOTenant | Select-Object SharingCapability, OneDriveSharingCapability, DefaultSharingLinkType, DefaultLinkPermission, RequireAnonymousLinksExpireInDays | Format-List

How to verify

Check output shows DefaultSharingLinkType = Direct, DefaultLinkPermission = View, and either Anyone links not allowed or RequireAnonymousLinksExpireInDays set to a value greater than 0.

Sources

This control is in the M365 Copilot Readiness Kit

The free Top 5 has this control with its Jira import, Excel project plan, tracker CSV and the read-only PowerShell script. The Complete kit has all 24 controls.

Download the free Top 5 See the kit