# Anonymous Links Expiry

> This policy sets an expiration date for anonymous sharing links, limiting how long external users can access shared content.

This policy sets an expiration date for anonymous sharing links, limiting how long external users can access shared content. Expiring links after a defined period reduces the risk of unauthorized access and helps maintain control over shared resources.

## Settings this baseline controls

| Setting                       | What it does                                                                                                                                                                                                                         |
| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Anonymous link expiry in days | Specifies the number of days before anonymous links expire. The value must be at least 0, and no more than 730. [Learn more](https://learn.microsoft.com/en-us/powershell/module/sharepoint-online/set-spotenant?view=sharepoint-ps) |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline makes "Anyone" links in SharePoint and OneDrive expire after 90 days. It applies
to the whole tenant.

1. **Add the baseline to the tenant** ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or deploy it to many
   tenants at once as part of a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. Set **Anonymous link expiry in days** to `90`. Every "Anyone" link the tenant creates from
   then on stops working automatically after 90 days. The value can be anywhere from 0 to 730,
   but 90 is what this baseline requires.
3. The expiry only takes effect where the tenant's sharing policy allows **Anyone** links; if it
   doesn't, there's nothing for an expiry to apply to (see
   [Global Default Sharing Policy](https://docs.octiga.io/baselines/sharing/org-anonymous-links-sharing-policy/)).
4. Save. Turn on **Auto-remediation** and Octiga puts the expiry back to 90 days automatically if
   it's changed or removed in Microsoft 365.

> **Caution:** Shortening the expiry also shortens links that already exist: an "Anyone" link created with a
> longer or no expiry updates to expire in 90 days once this applies, so anyone relying on an
> older link may lose access sooner than they expected.

> **Licence: SharePoint Online:**

## Check it worked

**Passing** means SharePoint Online's anonymous link expiry reports `90`. Check it in the
SharePoint admin centre, under
**Policies → Sharing → Advanced settings for "Anyone" links → Link expiration**. Users notice
nothing when they create a new "Anyone" link; it stops working 90 days later without further
warning.

## Standards this addresses

### CIS

- **M365 7.2.9** — CIS M365 Foundations Benchmark 7.2.9
- **v8 3.3** — CIS Controls v8 Safeguard 3.3

### NIST

- **PR.AC-3** — NIST CSF 2.0 PR.AC-3
- **PR.DS-5** — NIST CSF 2.0 PR.DS-5
- **AC-20** — NIST SP 800-53 AC-20

### ISO 27001

- **A.8.12** — ISO/IEC 27001:2022 Annex A.8.12
- **A.8.23** — ISO/IEC 27001:2022 Annex A.8.23

### GDPR

- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)