OneDrive sharing and permissions

OneDrive sharing looks simple — click Share, type an email, send — but several layers of policy decide what the user can actually do. Knowing the layers helps users share confidently and admins set sane defaults.

The link types

When a user shares a file or folder, they pick a link type:

Anyone with the link — no sign-in needed; the most permissive.
People in your organisation — requires a tenant sign-in.
People with existing access — generates a link for people already permissioned, doesn't grant new access.
Specific people — explicit recipients; the link only works for them.

Each link also has a permission: View, Edit, or (for documents) Review / Block download. Anyone links can additionally have an expiration date and a password.

Tenant defaults

The OneDrive section of the SharePoint admin center sets tenant-wide defaults:

Maximum external sharing level (Anyone / New and existing guests / Existing guests only / Only people in your organisation).
Default link type (Anyone / Specific people / People in org).
Default link permission (View / Edit).
Anyone-link expiration (e.g. 30 days).
File-type restrictions.

Defaults are the most impactful lever — most users accept whatever the dialog offers.

Per-user OneDrive controls

Beyond the tenant defaults:

External sharing can be restricted per user via Entra ID Conditional Access policies and OneDrive-specific external sharing policies.
Block download policies (via SharePoint Advanced Management) prevent local copies while still allowing viewing.
Sensitivity labels applied to a file can override what link types are allowed and add encryption/usage rights.

Recoverability

If a user is offboarded, their OneDrive moves to a 30-day retention state by default — the manager (or whoever the admin set) becomes the new owner and can recover content. Extending this with Purview retention policies (years rather than days) is common where regulatory or HR needs require it.

Practical guidance

A reasonable baseline for most tenants:

Default link: People in your organisation, View.
Anyone-link expiration: 30 days.
Block external sharing of files labelled Confidential or higher.
Quarterly access reviews on high-traffic OneDrives.

Anyone-link sharing isn't inherently bad — it's incredibly useful for "share a deck with a client." But make it a deliberate choice, not the default.

A sensitivity label applied to a file can cap what a user is offered when they click Share, regardless of the tenant's default link settings — a label configured with encryption and a "content marked confidential can only be shared with people in the organisation" content-sharing restriction removes the Anyone and People-in-org-with-external-guest-eligibility options from that file's Share dialog entirely, rather than merely warning the user against choosing them. This is a meaningfully stronger control than tenant-default link settings alone, because it travels with the specific file rather than depending on whichever library or site it happens to be sitting in — a labelled file downloaded and re-uploaded elsewhere in the tenant keeps the same sharing restriction.

Frequently asked questions

Does an "Anyone" link expire if the tenant default expiration is changed after the link was created? No — the expiration is set at the point the link is generated, using whatever policy was in effect then; changing the tenant default afterward doesn't retroactively shorten or extend links already issued, so a policy tightening needs a separate cleanup pass (via a script or SharePoint Advanced Management reporting) to find and revoke pre-existing longer-lived links if the change is meant to apply universally.

Can a user see who they've shared a file with, after the fact? Yes — the "Manage access" panel on any file or folder lists every current link and every person with direct access, and lets the owner revoke a link or remove a person's access at any time; this is also where an admin or SharePoint Advanced Management's permissions reports pull from when auditing who can reach a specific file.

Does sharing a OneDrive file count against the recipient's own storage quota? No — sharing a file grants access to the original copy in the owner's OneDrive; it doesn't create a duplicate that consumes the recipient's quota. Only an explicit copy or download-and-re-upload by the recipient creates a second, independent file that would count against their own storage.