SharePoint and OneDrive external sharing explained: tenant, site and link settings

Whether a user can share a file with someone outside your organization isn't decided by one switch. The organization setting, the site's own setting, the default link type, Anyone-link rules, domain lists and Microsoft Entra settings all have a say. When sharing fails, or works more widely than you intended, the cause is usually a layer nobody checked. In this post I'll explain how the layers combine, where each lives in the SharePoint admin center and PowerShell, and what a sensible baseline looks like.

How it works: the most restrictive layer wins#

The organization-level setting is the ceiling. In the SharePoint admin center, Policies › Sharing has one slider for SharePoint and one for OneDrive, and OneDrive can be more restrictive than SharePoint but never more permissive. Every site, including each user's OneDrive, then has its own setting at the same level or lower. The four levels map to the SharingCapability values you'll see in PowerShell:

On top of the levels sit link settings (default link type, default permission, Anyone-link expiry and permissions) and "who" settings: domain allow or block lists, which users may share externally, and Microsoft Entra external collaboration settings. With SharePoint and OneDrive integration with Microsoft Entra B2B enabled, sharing with a specific external person always creates a guest account and Entra settings apply. Without it, file and folder shares use SharePoint's own external authentication, but site sharing always uses Entra B2B, so Entra's guest invite settings and domain restrictions always matter.

Step-by-step#

1. Read the current configuration#

Start with an inventory from the SharePoint Online Management Shell, run as a SharePoint Administrator:

Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

Get-SPOTenant | Format-List SharingCapability, OneDriveSharingCapability, CoreDefaultShareLinkScope,
    CoreDefaultShareLinkRole, OneDriveDefaultShareLinkScope, OneDriveDefaultShareLinkRole,
    DefaultSharingLinkType, DefaultLinkPermission, RequireAnonymousLinksExpireInDays, FileAnonymousLinkType,
    FolderAnonymousLinkType, SharingDomainRestrictionMode, SharingAllowedDomainList,
    SharingBlockedDomainList, PreventExternalUsersFromResharing, EnableAzureADB2BIntegration

# How many sites sit at each level, and which allow Anyone links
Get-SPOSite -Limit All | Group-Object SharingCapability | Select-Object Name, Count
Get-SPOSite -Limit All | Where-Object SharingCapability -eq "ExternalUserAndGuestSharing" |
    Select-Object Url, Title

Get-SPOSite leaves out OneDrive sites unless you add -IncludePersonalSite $true.

2. Set the organization level#

For most tenants, New and existing guests is the right ceiling for SharePoint, with OneDrive at the same level or lower. Choose Anyone only for a clear need, such as file requests, which require OneDrive at Anyone with edit permission for Anyone links. Then expand More external sharing settings:

• Limit external sharing by domain: an allow or block list of up to 5,000 domains.
• Allow only users in specific security groups to share externally: useful when only some teams work with partners.
• Allow guests to share items they don't own: clear it unless guests genuinely need to pass on content they don't own.
• Guest access to a site or OneDrive will expire automatically after this many days: limits how long forgotten guest access lasts.
• People who use a verification code must reauthenticate after this many days: replaced by the Entra setting when B2B integration is on.

3. Set link defaults and Anyone-link rules#

Under File and folder links, choose the default link type: Specific people, Only people in your organization or Anyone with the link, plus the default permission. A safe default is Specific people with View. Organization-wide links are convenient, but they widen internal access, which matters for Microsoft 365 Copilot (see finding and fixing SharePoint oversharing). If Anyone links are allowed, require them to expire and limit their permissions. The same baseline in PowerShell:

Set-SPOTenant -SharingCapability ExternalUserSharingOnly -OneDriveSharingCapability ExternalUserSharingOnly `
    -CoreDefaultShareLinkScope SpecificPeople -CoreDefaultShareLinkRole View `
    -OneDriveDefaultShareLinkScope SpecificPeople -OneDriveDefaultShareLinkRole View `
    -PreventExternalUsersFromResharing $true -RequireAcceptingAccountMatchInvitedAccount $true

# Only if you allow Anyone links
Set-SPOTenant -RequireAnonymousLinksExpireInDays 30 -FileAnonymousLinkType View -FolderAnonymousLinkType View

The Core parameters set the default link for SharePoint sites and the OneDrive ones for OneDrive; SpecificPeople is Specific people. They're the tenant-wide form of the scope and role settings that Microsoft's Set-SPOSite reference says replace -DefaultSharingLinkType (where Direct meant Specific people) and -DefaultLinkPermission. Set-SPOTenant still lists that older pair; treat it as deprecated and use the new names in new scripts. RequireAcceptingAccountMatchInvitedAccount makes guests redeem an invitation with the account it was sent to, so a forwarded invitation is useless to anyone else.

4. Make per-site exceptions#

Open Sites › Active sites, select a site, and on the Settings tab change External file sharing. More sharing settings on the same tab lets that site use its own default link type, permission and Anyone-link expiry. In PowerShell, a site's default link is now set with -DefaultShareLinkScope and -DefaultShareLinkRole, which replace -DefaultSharingLinkType and -DefaultLinkPermission, although the Set-SPOSite reference's lists of parameters valid for OneDrive and group-connected sites still name only the older pair. Typical patterns: finance and HR sites at Only people in your organization, a partner project site open to one domain:

Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/Finance" -SharingCapability Disabled

Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/ProjectX" -SharingCapability ExternalUserSharingOnly `
    -SharingDomainRestrictionMode AllowList -SharingAllowedDomainList "fabrikam.com"

Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/Marketing" `
    -OverrideTenantAnonymousLinkExpirationPolicy $true -AnonymousLinkExpirationInDays 7

For one user's OneDrive, use Users › Active users › user › OneDrive › Manage external sharing in the Microsoft 365 admin center, or run Set-SPOSite against their OneDrive URL.

Verify#

• Rerun the inventory. Good looks like sites at the levels you designed, no unexpected ExternalUserAndGuestSharing sites, and RequireAnonymousLinksExpireInDays above 0 wherever Anyone links exist.
• Check one site in detail: Get-SPOSite -Identity <url> | Format-List SharingCapability, SharingDomainRestrictionMode, SharingAllowedDomainList.
• From a pilot account, share a file on the partner site with an allowed address (it works) and with another domain (it's refused). On the finance site, the share dialog shouldn't accept external people.
• Open the link settings in the share dialog: Anyone with the link should appear only where the site allows it.

Tips & gotchas#

• Lowering a level affects existing shares. Guests typically lose access within an hour, and they regain it if you raise the level again, so clean up sensitive sites first.
• Default link fallback. If the default is Anyone with the link but a site doesn't allow Anyone links, users get Only people in your organization and must switch to Specific people to share externally.
• Shortening Anyone-link expiry applies to existing links; lengthening it doesn't extend them.
• Two domain lists. SharePoint's list and the Entra allow or deny list both apply; check both when a partner can't be invited.
• Teams-connected sites also depend on Microsoft 365 Groups and Teams guest settings; see external access vs guest access in Teams.
• Sensitivity labels for groups and sites can set a site's external sharing level when the label is applied, which keeps confidential sites consistent.

References#

• Manage sharing settings for SharePoint and OneDrive in Microsoft 365
• Set-SPOTenant
• Set-SPOSite