SharePoint and OneDrive sharing settings, explained

SharePoint and OneDrive hold most of the files in a typical Microsoft 365 tenant, and Teams stores its files there too. Who can open those files depends on a stack of settings: one for the whole organisation, one for each site, the type of link someone chooses when they share, and the permissions each folder and file inherits. This page explains how Microsoft’s documentation describes each layer of SharePoint and OneDrive external sharing settings.

Organisation-level sharing levels

Microsoft’s sharing documentation describes four external sharing levels, from most to least open:

Microsoft states that “the OneDrive setting can be more restrictive than the SharePoint setting, but not more permissive”, and that the SharePoint setting “applies to all site types, including sites connected to Microsoft 365 groups and teams”.

How to find the organisation-level settings

Based on Microsoft’s instructions (checked October 2026). Menus can change; Microsoft’s sharing settings page has the latest steps.

1. Open the SharePoint admin center.
2. Expand Policies, then select Sharing.
3. The External sharing sliders show the SharePoint and OneDrive levels. More external sharing settings and File and folder links hold the Anyone link, default link and guest options described below.

Site-level sharing

Microsoft states that “each site has its own sharing setting that you can set independently, though it must be at the same or more restrictive setting as the organization”. Its page on changing a site’s settings adds:

• Changing a site’s sharing settings needs at least the SharePoint Administrator role. Microsoft states that “site owners can’t change these settings”. The guide to Microsoft 365 admin roles and least privilege explains how Microsoft describes assigning admin roles.
• A site can override the organisation’s default link type, link permissions and guest expiry.
• If organisation-level sharing is turned back on, Microsoft says the site setting “returns to what it was before and the shared links resume working”.
• If external sharing is later turned off for the organisation, Microsoft states that it “becomes unavailable at the site level and any shared links stop working”.
• “Guest sharing settings for Microsoft 365 Groups and Teams affect connected SharePoint sites”. Microsoft gives the default for group-connected sites as New and existing guests if group owners are allowed to add people from outside the organisation, and Existing guests otherwise.

How to change a site’s sharing setting

Based on Microsoft’s instructions (checked October 2026). Microsoft’s site sharing page has the latest steps.

1. In the SharePoint admin center, go to Active sites, signed in as at least a SharePoint Administrator.
2. Select the site. (For a channel site, select the link in the Channel sites column, then the site.)
3. On the Settings tab, select More sharing settings.
4. Choose an external sharing option, then select Save.

Anyone links

An Anyone link is the most open link type. Microsoft describes it as “available only if your external sharing setting is set to Anyone”, and states that with it “forwarded links work internally or externally, but you can’t track who has access to shared items or who has accessed shared items”.

Microsoft describes two restrictions an admin can place on Anyone links:

• Expiry. Anyone links can be required to expire within a maximum number of days. Microsoft explains that if the expiry time is changed, existing links keep their current expiry if the new setting is longer, and update if it’s shorter.
• Permissions. Anyone links can be restricted so they “can only provide view permission for files or folders”. Microsoft notes that the Request Files feature needs folder link permissions of View, edit, and upload or View and Upload, and that OneDrive settings other than Anyone disable file requests.

Default link types

The default link is the option already selected when someone clicks Share. Microsoft describes three choices:

• Specific people: “most restrictive”, and it “impedes broad internal sharing”.
• Only people in your organization: forwarded links “work for anyone in the organization”. Microsoft describes this as suiting organisations that share broadly internally and rarely externally.
• Anyone with the link: Microsoft describes it as “best for friction-free sharing if most files and folders in SharePoint and OneDrive aren’t sensitive”.

Microsoft notes that if Anyone is the default but a site only allows sharing with guests who sign in, the default for that site becomes Only people in your organization.

A fictional example: Mia at yourbusiness.example wants to send a price list to one supplier. If the default link is Anyone, the link she copies works for whoever it is forwarded to. If the default is Specific people, she has to name the supplier, and the link works only for them.

Guest sharing

Microsoft describes guests as people outside the organisation who prove who they are by signing in or entering a code. Its documentation describes settings for:

• Guest expiry: guest access to a site or OneDrive can be set to expire automatically after a number of days.
• Reauthentication: people who use a verification code can be required to reauthenticate after a set number of days. Microsoft notes that if Azure B2B collaboration is enabled, the Microsoft Entra setting is used instead. The guide to Microsoft 365 guest access and Entra B2B guest users explains how those guests work.

Teams has its own guest and external access settings, covered in the guide to Teams external access vs guest access.

Permission inheritance

Microsoft explains that “permissions inheritance means that the permission settings of an element in a site collection are passed on to the children of that element”. A folder normally has the same permissions as its library, and the library the same as its site.

Breaking inheritance gives an item its own permissions, starting as a copy of the parent’s. Microsoft notes that sharing does this automatically: when someone shares a folder, “SharePoint automatically handles all the details of permissions and access by breaking inheritance on the folder itself”.

Microsoft’s guidance on site permissions is: “don’t break inheritance”. It describes using the built-in SharePoint groups for communication sites, managing team site permissions through the associated Microsoft 365 group, and using sharing links for individual files and folders, saying this “makes administration much easier”.

How this relates to Copilot oversharing

Microsoft states that “Microsoft Copilot only surfaces organizational data to which individual users have at least view permissions”. It continues that “it’s important that you’re using the permission models available in Microsoft 365 services, such as SharePoint, to help ensure the right users or groups have the right access to the right content”.

SharePoint Advanced Management features

Microsoft describes SharePoint Advanced Management (SAM) as governance controls for SharePoint and OneDrive, managed mainly through the SharePoint admin center. Its overview lists, among others:

• Restricted access control, to “restrict access to SharePoint or OneDrive sites to specific groups”
• Data access governance reports, to “identify sites that might contain overshared or sensitive content”
• Restricted Content Discovery, which Microsoft says limits discovery of content from specific sites “in organization-wide search results and Microsoft Copilot responses”. Microsoft states it “doesn’t change existing permissions”: people who already have access can still open the content directly. Microsoft also cautions that excessive use “can reduce the amount of content available to organization-wide search and Microsoft Copilot experiences”.

On licensing, Microsoft’s Restricted Content Discovery page says it can be configured “if your organization is licensed for Copilot and has SharePoint Advanced Management available”. Microsoft’s SAM prerequisites page sets out the licences for the other features.

Based on Microsoft’s description, Copilot works within the permissions that already exist, so the sharing levels, links and inheritance described above shape what it can show each person. The guide to SharePoint oversharing and Microsoft 365 Copilot covers this in more detail, and the guide to sensitivity labels and DLP covers Purview features that work alongside sharing settings.

Things to watch for

• Links that stop working. Microsoft states that if external sharing is turned off for the organisation, shared links stop working (and resume if it’s turned back on).
• Anyone links can’t be tracked. Microsoft says forwarded Anyone links work for whoever has them, with no record of who has access.
• Teams and group settings. Microsoft says guest settings for Microsoft 365 Groups and Teams affect their connected SharePoint sites, so a change in one place can show up in the other.
• What Copilot can show. Copilot works within existing permissions, according to Microsoft, so broad sharing also widens what it can surface.

Common questions

How do I turn off external sharing in SharePoint?

Microsoft describes the most restrictive organisation-level setting as “Only people in your organization”, which turns external sharing off. The sliders are in the SharePoint admin center under Policies > Sharing. Microsoft states that if external sharing is turned off for the organisation, any shared links stop working, and they resume if it’s turned back on. How to find the organisation-level settings has Microsoft’s steps.

What are the SharePoint external sharing levels?

Microsoft describes four levels, from most to least open: Anyone, New and existing guests, Existing guests, and Only people in your organization. Microsoft states that the OneDrive setting can be more restrictive than the SharePoint setting, but not more permissive, and that each site must be at the same or a more restrictive setting than the organisation. Organisation-level sharing levels explains each one.

Can I make SharePoint Anyone links expire?

Yes. Microsoft describes an admin setting that requires Anyone links to expire within a maximum number of days, and another that restricts them to view permission only. Microsoft explains that if the expiry time is changed, existing links keep their expiry if the new setting is longer, and update if it’s shorter. Anyone links covers both restrictions.

Can a site owner change a SharePoint site’s sharing settings?

No, according to Microsoft. Its page states that “site owners can’t change these settings”; changing a site’s sharing settings needs at least the SharePoint Administrator role. A site can be more restrictive than the organisation, and can override the default link type, link permissions and guest expiry. Site-level sharing and how to change a site’s sharing setting have the detail.

What’s the safest default sharing link type?

Microsoft describes Specific people as the “most restrictive” default, noting it “impedes broad internal sharing”. Only people in your organization suits organisations that share broadly internally and rarely externally, and Anyone with the link is described as “best for friction-free sharing if most files and folders in SharePoint and OneDrive aren’t sensitive”. Default link types compares the three with a fictional example.

Can Copilot see files that have been overshared?

Microsoft states that Copilot “only surfaces organizational data to which individual users have at least view permissions”. Based on that description, the sharing levels, links and inheritance on a tenant shape what Copilot can show each person, so broad sharing also widens what it can surface. How this relates to Copilot oversharing covers SharePoint Advanced Management features Microsoft describes.

Related guides

• Copilot and oversharing
• Teams external access and guest access
• The shared responsibility model