The master switch: SharingCapability
One tenant property sets the ceiling for the whole estate:
SharingCapability value |
What it permits |
|---|---|
| Disabled | Internal only — no external sharing at all |
| ExistingExternalUserSharingOnly | Only guests already in the directory; no new external invites |
| ExternalUserSharingOnly | New guests allowed, but they must authenticate (no Anyone links) |
| ExternalUserAndGuestSharing | The most permissive — enables Anyone (anonymous) links |
The rule that trips people up: the tenant caps the site, not the other way
round. A site's SharingCapability (set per-site with Set-SPOSite) can only
be equal to or more restrictive than the tenant's. Set the tenant to
ExternalUserSharingOnly and no site can ever hand out an Anyone link, whatever a
site owner clicks. OneDrive has its own ceiling — OneDriveSharingCapability —
so you can lock personal storage tighter than team sites.
The default-behaviour dials
These decide what a normal user gets offered by default — and defaults ARE the behaviour of a tenant:
DefaultSharingLinkType—Direct(Specific people),Internal(People in org), orAnonymousAccess(Anyone). Set it toDirect. This single change is the highest-leverage anti-oversharing move you can make.DefaultLinkPermission—VieworEdit. Default toView.FileLinkType/FolderLinkTypefor Anyone links, andRequireAnonymousLinksExpireInDays— force anonymous links to die on a clock.
The external guard-rails
SharingDomainRestrictionMode=AllowListorBlockList, paired withSharingAllowedDomainList/SharingBlockedDomainList— confine external sharing to partner domains, or block consumer ones.ExternalUserExpirationRequired+ExternalUserExpireInDays— auto-expire guest access so dormant guests don't accumulate forever.RequireAcceptingAccountMatchInvitedAccount— stop an invite forwarded to a different address from being redeemed by whoever received it.
The failure mode
The trap is silent regression: a support engineer flips the tenant to
ExternalUserAndGuestSharing for one urgent external collaboration and never flips
it back, or a default link type creeps back to Internal after a tenant migration
or a support ticket. Nothing breaks; the posture just quietly widened. Because
these are org-wide and rarely re-examined, drift here is invisible without a
baseline — which is exactly why serv365 snapshots Get-SPOTenant nightly.
What to watch (proofs)
- The sharing DNA in one shot:
Get-SPOTenant | fl SharingCapability, OneDriveSharingCapability, DefaultSharingLinkType, DefaultLinkPermission, RequireAnonymousLinksExpireInDays, SharingDomainRestrictionMode— the versioned baseline; any delta is a dated drift alert. - The site-vs-tenant check:
Get-SPOSite <url> | fl SharingCapability— a site claiming looser sharing than the tenant is impossible; a site tighter than the tenant is deliberate containment worth recording. - Domain lists actually populated:
Get-SPOTenant | fl SharingAllowedDomainList— an AllowList mode with an empty list blocks all external sharing (a common self-inflicted outage). - Guest expiry live:
Get-SPOTenant | fl ExternalUserExpirationRequired, ExternalUserExpireInDays— off means guests are forever.