# Global Default Sharing Policy

> Controls the organisation-wide sharing level for SharePoint and OneDrive.

Controls the organisation-wide sharing level for SharePoint and OneDrive. This setting defines the maximum external sharing allowed across the tenant and governs how users can share files, folders, and sites.

## Settings this baseline controls

| Setting                          | What it does                                                                                                                                                                                         |
| -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| SharePoint external sharing      | Determines what level of sharing is available for SharePoint sites. [Learn more](https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenant?view=sharepoint-ps)             |
| OneDrive external sharing        | Determines what level of sharing is available for OneDrive. [Learn more](https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenant?view=sharepoint-ps)                     |
| Default link type                | The default link type for sharing (None, Direct, Internal, or AnonymousAccess). [Learn more](https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenant?view=sharepoint-ps) |
| Default link permission          | The default link permission (View or Edit). [Learn more](https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenant?view=sharepoint-ps)                                     |
| Viewer names shown in SharePoint | Controls whether user display names are shown to viewers in SharePoint. [Learn more](https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenant?view=sharepoint-ps)         |
| Viewer names shown in OneDrive   | Controls whether user display names are shown to viewers. [Learn more](https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenant?view=sharepoint-ps)                       |
| Anonymous folder link permission | The type of anonymous access links for folders (View or Edit). [Learn more](https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenant?view=sharepoint-ps)                  |
| Anonymous file link permission   | The type of anonymous access links for files (View or Edit). [Learn more](https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenant?view=sharepoint-ps)                    |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline tightens SharePoint and OneDrive's default sharing policy for the whole tenant.

1. **Add the baseline to the tenant** ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or deploy it to many
   tenants at once as part of a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. Set **SharePoint external sharing** and **OneDrive external sharing** to **Existing guests**.
   This limits sharing to guests already in the tenant's directory, rather than **Anyone** (fully
   anonymous links) or **New and existing guests** (anyone who signs in or verifies a code).
3. Set **Default link type** to **Specific people** and **Default link permission** to **View**,
   so the link a user is offered by default is the most restrictive one, not the widest.
4. Leave **Viewer names shown in SharePoint** and **Viewer names shown in OneDrive** on, so an
   owner can still see who has viewed a file they've shared.
5. Save. Turn on **Auto-remediation** and Octiga puts these values back automatically if the
   tenant's sharing policy is loosened again in Microsoft 365.

> **Caution:** Moving **SharePoint external sharing** or **OneDrive external sharing** away from **Anyone**
> revokes access for anyone still relying on an existing anonymous link. It also breaks File
> Requests, which needs OneDrive set to **Anyone**.

## Check it worked

**Passing** means SharePoint Online's sharing policy matches all of the values above. Check
them in the SharePoint admin centre, under **Policies → Sharing**. Once this applies, anyone
trying to share externally can only reach guests already in the organisation's directory, and
the link type and permission offered by default are **Specific people** and **View**.

## Standards this addresses

### CIS

- **M365 7.2.3** — CIS M365 Foundations Benchmark 7.2.3
- **v8 3.3** — CIS Controls v8 Safeguard 3.3

### NIST

- **PR.AC-3** — NIST CSF 2.0 PR.AC-3
- **PR.DS-5** — NIST CSF 2.0 PR.DS-5
- **AC-20** — NIST SP 800-53 AC-20

### ISO 27001

- **A.8.12** — ISO/IEC 27001:2022 Annex A.8.12
- **A.8.23** — ISO/IEC 27001:2022 Annex A.8.23

### GDPR

- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)