oeltayeb.com · Microsoft 365 Admin Toolkit

Reference

External sharing settings reference

Based on the article: SharePoint and OneDrive external sharing explained: tenant, site and link settings · 5 min read

Whether a user can share a file with someone outside your organization isn't decided by one switch. The organization setting, the site's own setting, the default link type, Anyone-link rules, domain lists and Microsoft Entra settings all have a say. When sharing fails, or works more widely than you intended, the cause is usually a layer nobody checked. In this post I'll explain how the layers combine, where each lives in the SharePoint admin center and PowerShell, and what a sensible baseline looks like.

How it works: the most restrictive layer wins

The organization-level setting is the ceiling. In the SharePoint admin center, Policies › Sharing has one slider for SharePoint and one for OneDrive, and OneDrive can be more restrictive than SharePoint but never more permissive. Every site, including each user's OneDrive, then has its own setting at the same level or lower. The four levels map to the SharingCapability values you'll see in PowerShell:

Admin center levelSharingCapabilityWhat users can do
AnyoneExternalUserAndGuestSharingCreate Anyone links that work without sign-in, and share with guests
New and existing guestsExternalUserSharingOnlyShare with new people, who sign in or enter a verification code
Existing guestsExistingExternalUserSharingOnlyShare only with guests already in your directory
Only people in your organizationDisabledNo external sharing

On top of the levels sit link settings (default link type, default permission, Anyone-link expiry and permissions) and "who" settings: domain allow or block lists, which users may share externally, and Microsoft Entra external collaboration settings. With SharePoint and OneDrive integration with Microsoft Entra B2B enabled, sharing with a specific external person always creates a guest account and Entra settings apply. Without it, file and folder shares use SharePoint's own external authentication, but site sharing always uses Entra B2B, so Entra's guest invite settings and domain restrictions always matter.

Step-by-step

1. Read the current configuration

Start with an inventory from the SharePoint Online Management Shell, run as a SharePoint Administrator:

powershell
Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

Get-SPOTenant | Format-List SharingCapability, OneDriveSharingCapability, CoreDefaultShareLinkScope,
    CoreDefaultShareLinkRole, OneDriveDefaultShareLinkScope, OneDriveDefaultShareLinkRole,
    DefaultSharingLinkType, DefaultLinkPermission, RequireAnonymousLinksExpireInDays, FileAnonymousLinkType,
    FolderAnonymousLinkType, SharingDomainRestrictionMode, SharingAllowedDomainList,
    SharingBlockedDomainList, PreventExternalUsersFromResharing, EnableAzureADB2BIntegration

# How many sites sit at each level, and which allow Anyone links
Get-SPOSite -Limit All | Group-Object SharingCapability | Select-Object Name, Count
Get-SPOSite -Limit All | Where-Object SharingCapability -eq "ExternalUserAndGuestSharing" |
    Select-Object Url, Title

Get-SPOSite leaves out OneDrive sites unless you add -IncludePersonalSite $true.

2. Set the organization level

For most tenants, New and existing guests is the right ceiling for SharePoint, with OneDrive at the same level or lower. Choose Anyone only for a clear need, such as file requests, which require OneDrive at Anyone with edit permission for Anyone links. Then expand More external sharing settings:

3. Set link defaults and Anyone-link rules

Under File and folder links, choose the default link type: Specific people, Only people in your organization or Anyone with the link, plus the default permission. A safe default is Specific people with View. Organization-wide links are convenient, but they widen internal access, which matters for Microsoft 365 Copilot (see finding and fixing SharePoint oversharing). If Anyone links are allowed, require them to expire and limit their permissions. The same baseline in PowerShell:

powershell
Set-SPOTenant -SharingCapability ExternalUserSharingOnly -OneDriveSharingCapability ExternalUserSharingOnly `
    -CoreDefaultShareLinkScope SpecificPeople -CoreDefaultShareLinkRole View `
    -OneDriveDefaultShareLinkScope SpecificPeople -OneDriveDefaultShareLinkRole View `
    -PreventExternalUsersFromResharing $true -RequireAcceptingAccountMatchInvitedAccount $true

# Only if you allow Anyone links
Set-SPOTenant -RequireAnonymousLinksExpireInDays 30 -FileAnonymousLinkType View -FolderAnonymousLinkType View

The Core parameters set the default link for SharePoint sites and the OneDrive ones for OneDrive; SpecificPeople is Specific people. They're the tenant-wide form of the scope and role settings that Microsoft's Set-SPOSite reference says replace -DefaultSharingLinkType (where Direct meant Specific people) and -DefaultLinkPermission. Set-SPOTenant still lists that older pair; treat it as deprecated and use the new names in new scripts. RequireAcceptingAccountMatchInvitedAccount makes guests redeem an invitation with the account it was sent to, so a forwarded invitation is useless to anyone else.

4. Make per-site exceptions

Open Sites › Active sites, select a site, and on the Settings tab change External file sharing. More sharing settings on the same tab lets that site use its own default link type, permission and Anyone-link expiry. In PowerShell, a site's default link is now set with -DefaultShareLinkScope and -DefaultShareLinkRole, which replace -DefaultSharingLinkType and -DefaultLinkPermission, although the Set-SPOSite reference's lists of parameters valid for OneDrive and group-connected sites still name only the older pair. Typical patterns: finance and HR sites at Only people in your organization, a partner project site open to one domain:

powershell
Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/Finance" -SharingCapability Disabled

Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/ProjectX" -SharingCapability ExternalUserSharingOnly `
    -SharingDomainRestrictionMode AllowList -SharingAllowedDomainList "fabrikam.com"

Set-SPOSite -Identity "https://contoso.sharepoint.com/sites/Marketing" `
    -OverrideTenantAnonymousLinkExpirationPolicy $true -AnonymousLinkExpirationInDays 7

For one user's OneDrive, use Users › Active users › user › OneDrive › Manage external sharing in the Microsoft 365 admin center, or run Set-SPOSite against their OneDrive URL.

Verify

Tips & gotchas

References