The three link types
| Link | Who it grants to | Risk shape |
|---|---|---|
| Anyone (anonymous) | Anyone with the URL, no sign-in | The exfiltration link — off in most tenants by design |
| People in your organization | ANY signed-in tenant user | The quiet oversharing engine — 'share with the team' becomes 'readable by all 5,000 staff' |
| People with existing access | Nobody new — just a convenient URL | Safe |
| Specific people | Named individuals/groups | Least privilege — the one to prefer |
The insight the oversharing runbook depends on: a People-in-your-organization link makes that item effectively org-wide, and Copilot retrieves under effective access — so a few years of casual org-links is precisely how 'summarise anything about redundancies' returns a hit. The link, not a permission grant, is the exposure.
The bounding settings (tenant + site)
- Anyone-link toggle and its default expiry (force expiry so anonymous links die on a clock).
- Default link type — set it to Specific people, not the permissive default; this one change reshapes the sharing habit of the whole tenant.
- Per-site external-sharing level cannot exceed the tenant level (the tenant caps the site — the security module).
- Domain allow/deny lists for Anyone/guest sharing.
All of these are in serv365's nightly scan of SPOTenant — the default link
type or Anyone-expiry drifting back to permissive is exactly the security-posture
regression drift alerting exists for.
What to watch (proofs)
- The tenant stance:
Get-SPOTenant | fl SharingCapability, DefaultSharingLinkType, DefaultLinkPermission, RequireAnonymousLinksExpireInDays— the sharing DNA of the tenant, versioned nightly. - Link inventory at scale: SharePoint Advanced Management's sharing-link reports (oversharing concept) — how many org-wide and Anyone links exist, and where.
- The habit test: share a file as a normal user — does the default offered link read 'Specific people' or 'People in your org'? The default is the behaviour.
- Expiry enforcement: an Anyone link's expiry date in the share dialog — present and short, or absent (a permanent anonymous door).