Global Default Sharing Policy
Controls the organisation-wide sharing level for SharePoint and OneDrive. This setting defines the maximum external sharing allowed across the tenant and governs how users can share files, folders, and sites.
Settings this baseline controls
| Setting | What it does |
|---|---|
| SharePoint external sharing | Determines what level of sharing is available for SharePoint sites. Learn more |
| OneDrive external sharing | Determines what level of sharing is available for OneDrive. Learn more |
| Default link type | The default link type for sharing (None, Direct, Internal, or AnonymousAccess). Learn more |
| Default link permission | The default link permission (View or Edit). Learn more |
| Viewer names shown in SharePoint | Controls whether user display names are shown to viewers in SharePoint. Learn more |
| Viewer names shown in OneDrive | Controls whether user display names are shown to viewers. Learn more |
| Anonymous folder link permission | The type of anonymous access links for folders (View or Edit). Learn more |
| Anonymous file link permission | The type of anonymous access links for files (View or Edit). Learn more |
Configure it
This baseline tightens SharePoint and OneDrive’s default sharing policy for the whole tenant.
-
Add the baseline to the tenant (Adding a baseline), or deploy it to many tenants at once as part of a scheme (Deploying a scheme).
-
Set SharePoint external sharing and OneDrive external sharing to Existing guests. This limits sharing to guests already in the tenant’s directory, rather than Anyone (fully anonymous links) or New and existing guests (anyone who signs in or verifies a code).
-
Set Default link type to Specific people and Default link permission to View, so the link a user is offered by default is the most restrictive one, not the widest.
-
Leave Viewer names shown in SharePoint and Viewer names shown in OneDrive on, so an owner can still see who has viewed a file they’ve shared.
-
Save. Turn on Auto-remediation and Octiga puts these values back automatically if the tenant’s sharing policy is loosened again in Microsoft 365.
Check it worked
Passing means SharePoint Online’s sharing policy matches all of the values above. Check them in the SharePoint admin centre, under Policies → Sharing. Once this applies, anyone trying to share externally can only reach guests already in the organisation’s directory, and the link type and permission offered by default are Specific people and View.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.