SharePoint sharing settings are rarely simple. In many of the Microsoft 365 tenants I review, the trade-off is plain to see. Open things up too far and collaboration runs smoothly until sensitive information ends up in the wrong inbox. Lock things down too hard and users find workarounds (often far worse for security), or work just slows down. Since January 2025, Microsoft 365 Copilot and Copilot Chat have made it even easier to surface content through search and summaries. A sensible baseline for external sharing in SharePoint and OneDrive is now a business requirement, not a nice-to-have.

My organisation-wide baseline starts with five sharing settings

Everything starts at SharePoint admin center → Policies → Sharing. This is the configuration I use as a starting point with most clients:

  • Restrict sharing to “New and existing guests.” B2B guest access is allowed, but only for users who have been explicitly invited. No more “Anyone with the link” shares going to random externals.
  • Set the default sharing link type to “Specific people.” New shares then only work for the named recipients, not for broad groups or anonymous users. The Microsoft documentation on default link types has the details.
  • Set the default permission to “View.” Users should pick Edit deliberately when they actually need it. It's the safer default in almost every environment.
  • Require link expiration on Anyone links (usually 30 days) and guest access expiration (e.g., 60–90 days). If someone forgets about a link, the risk window still closes fairly quickly. See Microsoft's docs on external sharing.
  • Use allowed/blocked domain lists if there are partner organisations that should always, or never, be able to access content.

Together these settings give people room to work while keeping data protected. If you want to understand how the individual controls interact, Microsoft's external sharing overview is a good read.

Sensitive sites get stricter site-level overrides

Not every area should be equally open. Leadership, HR or legal sites need tighter controls than, for example, a project collaboration site. In the SharePoint admin center you can override the organisation-wide settings per site. You can set external sharing to “Only people in your organisation”, which blocks all external sharing, or limit it to “Existing guests” if B2B guests should keep access but no new invites should go out. To go a step further, use authentication context and Conditional Access. I describe the setup I use in practice for sensitive SharePoint sites in Authentication context for securing sensitive SharePoint sites.

Tip: Check the access reports for sensitive SharePoint sites on a regular schedule, and especially after big projects or staff changes. Nasty surprises about who has access are common until someone actually looks.

Every external share creates an Entra B2B guest that needs a lifecycle

Each external share in SharePoint creates a B2B guest account in Microsoft Entra ID. That's why you have to manage link expiration and guest lifecycles together. Removing a share doesn't always remove the Entra guest. Deleting the guest in Entra revokes SharePoint access immediately, but it doesn't reliably work the other way round. Regular guest access reviews close that gap, and I've written about running them in Guest access reviews in Entra ID: cleaning up the mess. If you turn on guest expiration in the SharePoint admin center, make sure you also configure matching Entra ID policies (role: Global Admin or Privileged Role Admin).

Sharing reports and PowerShell show whether the baseline holds

To see what has actually been shared externally, go to Reports → Sharing in the SharePoint admin center. It breaks down sharing links and guest access in detail. In larger tenants I audit the baseline regularly with PowerShell (SharePoint Online Management Shell, Tenant Admin required):

# PowerShell 7, SharePoint Online Management Shell, Tenant Admin
Connect-SPOService -Url https://<tenant>-admin.sharepoint.com
Get-SPOTenant | Select DefaultSharingLinkType, SharingCapability, ExternalUserExpirationRequired, SharingAllowedDomainList, SharingBlockedDomainList

You can enforce the baseline with Set-SPOTenant, for example:

Set-SPOTenant -DefaultSharingLinkType SpecificPeople -SharingCapability ExternalUserAndGuestSharing -ExternalUserExpirationRequired $true -ExternalUserExpireInDays 60

I don't treat these reports as a compliance exercise only. They show whether users are getting around the policies and whether guest expiration is being ignored in day-to-day practice.

A clean sharing baseline limits what Copilot can overshare

Copilot and Copilot Chat now surface more content from SharePoint and OneDrive, so oversharing carries a real exposure risk. If a document is shared with a guest, Copilot may summarise or reference it for that guest (or for anyone else with access). I've seen “Anyone with the link” settings make supposedly internal content show up in Copilot where nobody expected it. With “Specific people” as the default, required guest reviews and sensible expiration periods, you keep the data Copilot works with as clean as possible and avoid a lot of privacy and compliance trouble. I go into oversharing and Copilot in more depth in Copilot oversharing: Blueprint priorities, site risk in practice.

The diagram below shows how these settings relate to what Copilot can actually access:

flowchart TD
    OrgSettings["Org sharing settings"] --> SiteSettings["Site sharing settings"]
    SiteSettings --> UserSharing["User shares document"]
    UserSharing --> EntraGuest["Entra B2B guest"]
    EntraGuest --> CopilotAccess["Copilot access"]
    SiteSettings --> CopilotAccess

Figure: How org and site sharing settings, guest management and Copilot interact

The baseline needs continuous review after you set it

A carefully planned SharePoint sharing settings baseline cuts risk considerably, keeps Copilot under control and saves effort over time. You can't set it once and forget about it, though. Guests come and go, new sites appear and collaboration needs change, so you'll have to look at the reports and adjust the settings regularly. In my experience, admins who do this run into far fewer surprises and sleep better for it.