OneDrive Sharing Policies and External Access

OneDrive sharing policies define how users can share files and folders with people inside and outside the organization. These policies are configured at three levels: tenant-level (organization-wide), site-level (per OneDrive site), and link-level (per share action). The tenant-level policy sets the most restrictive baseline; site-level policies can only be more restrictive, not more permissive. Link-level settings further refine access within a site's allowed sharing scope.

The tenant-level sharing policy is the topmost control. It is configured in the SharePoint admin center under Policies > Sharing. The key settings are:

- External sharing: Controls whether users can share with people outside the organization. Options: - Anyone (anonymous links): Users can share with anyone, no sign-in required. This is the most permissive option. - New and existing guests: Users can share with external users who authenticate using a Microsoft account or Azure AD B2B guest account. - Existing guests: Only share with external users already in your Azure AD directory. - Only people in your organization: No external sharing allowed. - External sharing expiration: For Anyone links, you can set a default expiration (1-365 days) and a default permission (view or edit). - External sharing for file and folder links: Control default link type (Anyone, People in your organization, Specific people). - Limit external sharing by domain: Allow or block sharing with specific domains. - Allow or block sharing with people using other Microsoft 365 organizations: For B2B direct connect. - Guest access to a site or OneDrive: Controls whether guests can access shared resources. - Let people outside your organization access your intranet content: For SharePoint.

These settings are stored in the SharePoint Online tenant configuration and are enforced by the SharePoint Online service. Changes take effect within minutes.

Each user's OneDrive site inherits the tenant-level policy by default. However, an admin can set a custom sharing policy for a specific OneDrive site using PowerShell or the SharePoint admin center. The site-level policy can only be more restrictive than the tenant-level policy. For example, if the tenant allows Anyone links, a site can disable them, but if the tenant disables Anyone links, a site cannot enable them.

To configure a OneDrive site's sharing policy via PowerShell:

Set-SPOSite -Identity https://contoso-my.sharepoint.com/personal/user_domain_com -SharingCapability ExternalUserAndGuestSharing

The -SharingCapability parameter accepts: - Disabled: No external sharing. - ExistingExternalSharing: Only share with existing guests. - ExternalUserAndGuestSharing: Allow sharing with new and existing guests. - ExternalUserSharingOnly: Allow sharing with authenticated external users only. - AnonymousLinkSharing: Allow Anyone links (requires tenant-level Anyone enabled).

When a user shares a file or folder, they can create a link with specific permissions. The available link types depend on the tenant and site policies:

Users can also set permissions (view or edit) and expiration dates on individual links. Admins can enforce default link types and expiration via sharing policies.

Key default values in Microsoft 365:

External sharing relies on Azure AD B2B collaboration. When a user shares with an external email address, the recipient receives an invitation email. If the recipient does not have an existing Microsoft account, they are prompted to create one or sign in with a work/school account. The guest user object is created in Azure AD and can be managed like any other user. The guest user's access is subject to Azure AD Conditional Access policies and guest user access controls.

Sensitivity labels can restrict sharing actions. For example, a label configured with "Control access" can prevent users from sharing files with that label externally. When a label is applied, the sharing policy is enforced by the Azure Information Protection client or built-in labeling. This can override more permissive sharing policies at the tenant level.

Sharing activities are logged in the Microsoft 365 audit log. Key events include: - SharingInvitationCreated - SharingInvitationAccepted - AnonymousLinkCreated - AnonymousLinkUsed - FileShared - FileAccessed

Admins can use the audit log to investigate external sharing activities.

Common PowerShell commands for managing sharing policies:

# Get tenant-level sharing policy
Get-SPOTenant | Select-Object -Property SharingCapability, RequireAcceptingAccountMatchInvitedAccount, ProvisionSharedWithEveryoneFolder, ShowEveryoneClaim, ShowEveryoneExceptExternalUsersClaim, ShowPeoplePickerSuggestionsForGuestUsers

# Set tenant-level sharing policy
Set-SPOTenant -SharingCapability ExternalUserAndGuestSharing -RequireAcceptingAccountMatchInvitedAccount $true

# Get site-level sharing policy
Get-SPOSite -Identity <SiteURL> | Select-Object SharingCapability

# Set site-level sharing policy
Set-SPOSite -Identity <SiteURL> -SharingCapability ExternalUserSharingOnly

# Set default link type
Set-SPOTenant -DefaultSharingLinkType Internal

# Set Anyone link expiration
Set-SPOTenant -AnonymousLinkExpirationInDays 30

Common issues and resolutions:

A multinational corporation requires that all external sharing must be authenticated and logged. They set the tenant-level external sharing to "New and existing guests" and disable Anyone links entirely. They enforce a default link type of "Specific people" to prevent accidental oversharing. Domain restrictions are configured to block sharing with personal email domains like gmail.com and yahoo.com, forcing users to share only with corporate partners. They also enable "Require accepting account match invited account" to prevent invitation forwarding. In production, this configuration reduces data leakage incidents by 80%. However, it increases friction for legitimate collaboration, so they create a process for approving exceptions via a security team. Misconfiguration often occurs when a site admin inadvertently sets a site-level policy that is more permissive than the tenant policy, but since the system prevents that, the error is usually a misunderstanding of the hierarchy. The main challenge is managing the guest lifecycle: guest accounts accumulate over time, so they implement Azure AD access reviews to periodically remove inactive guests.

A small marketing agency frequently shares large files with clients who do not have Microsoft accounts. They enable Anyone links with a 7-day expiration and view-only permission. They set the default link type to "Anyone" for convenience. The tenant-level sharing is set to "Anyone" with expiration and password protection enabled. In practice, they find that clients often lose the link, so they keep the default expiration short to limit exposure. The main performance consideration is that Anyone links bypass authentication, so there is no audit trail of who accessed the file. To mitigate this, they use SharePoint Online file access logs to see that the link was used, but not by whom. A common misconfiguration is forgetting to set an expiration, leading to permanent anonymous access. They use a PowerShell script to enforce a maximum expiration of 30 days on all Anyone links.

A healthcare provider must comply with HIPAA, which requires that all external sharing be encrypted and authenticated. They set external sharing to "New and existing guests" and disable Anyone links. They also use sensitivity labels to mark patient data as "Highly Confidential" and configure the label to prevent external sharing. When a user tries to share a labeled file externally, the label blocks the action even if the site policy allows it. In production, they must carefully manage guest access to ensure that business associates sign a BAA before being invited. They use Azure AD B2B with Conditional Access policies to require multi-factor authentication for guest access. A common issue is that users mistakenly share unlabeled files externally, bypassing the label restrictions. They address this with training and by enabling default labeling for all documents. The main performance consideration is that labeling can cause delays in sharing, especially for large files, due to the Azure Information Protection service.