Set the default sharing link type to specific people

Description

The link type selected by default when a user shares a file or folder in SharePoint or OneDrive is Specific people (DefaultSharingLinkType = Direct): the link only works for the people the user names. Users can still pick a broader link type if the sharing settings allow it.

Rationale

Most users accept the default link. A default of People in your organization or Anyone exposes content to everyone who receives a forwarded link, makes it visible to Copilot and search for every internal user who opens it, and leaves no record of the intended audience. Defaulting to named people limits oversharing without blocking any use case.

Impact

Users who want a broad link must change the link type in the sharing dialog. Sites and OneDrive accounts with their own default link setting keep it: review them with Get-SPOSite -Limit All | Select-Object Url, DefaultSharingLinkType.

Setting

Audit

1. Sign in to the SharePoint admin center (https://admin.microsoft.com/sharepoint) as at least a Global Reader.
2. Browse to Policies > Sharing > File and folder links and check that Specific people (only the people the user specifies) is selected.
3. With the SharePoint Online Management Shell (SharePoint Administrator): Get-SPOTenant | Select-Object DefaultSharingLinkType must return Direct. List site overrides with Get-SPOSite -Limit All | Where-Object { $_.DefaultSharingLinkType -notin 'None','Direct' }.
4. Fail if the tenant default is not Direct.

Remediation

1. In the SharePoint admin center, browse to Policies > Sharing > File and folder links, select Specific people (only the people the user specifies) and Save. Role: SharePoint Administrator.
2. PowerShell equivalent: Set-SPOTenant -DefaultSharingLinkType Direct.
3. Reset sites that override the default with Set-SPOSite -Identity <URL> -DefaultSharingLinkType None (inherit) or Direct.

References

• Change the default link type for sharing Microsoft, vendor-doc, accessed 2026-10-24
• Manage sharing settings for SharePoint and OneDrive in Microsoft 365 Microsoft, vendor-doc, accessed 2026-10-24
• Set-SPOTenant (SharePoint Online Management Shell) Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft SharePoint Online and OneDrive baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-COLLAB-009 Set the default sharing link permission to view

People and lifecycle