Why the default feels risky
Microsoft 365 makes sharing easy. In many tenants the widest option is or was open: a link anyone who has it can open, sometimes without signing in. Handy for a quick file hand-off — and hard to revoke once that link lands in a chat, a forward, or a public channel. For an SME the problem is rarely “sharing is forbidden”; it is “sharing without an agreement”.
External sharing is not a bug. It is a switch that needs policy: internal, with customers, with suppliers. Without that policy the link becomes the way of working.
What you should actually decide
Keep it short enough to decide this quarter:
- who may create external links or guest invites — everyone, or only owners and admins;
- anonymous links versus invited guests with an account only;
- maximum link lifetime (days or weeks, not “forever”);
- password or one-time code on sensitive links, where the licence and workflow allow it;
- whether personal consumer accounts may use your tenant — often better not for business collaboration.
Write those five points on one page. That is your sharing policy; the tenant follows that text, not the other way around.
What Floor ICT configures — and what you decide
In the Microsoft 365 tenant and the SharePoint admin centre we typically set: the organisation level for external sharing (off, existing guests only, new and existing guests, or anonymous links), default and maximum link expiry, and who may send guest invitations. Per site or OneDrive we can be stricter than the organisation level — never wider than what you allow.
You still decide: whether anonymous links are allowed at all, which teams get exceptions, and how you explain to staff when they may or may not share. Technical defaults without policy do not fix it; policy without configuration does not either.
Guests, anonymous, and consumer accounts
A guest is someone you invite who signs in — you see who had access. Anonymous is “anyone with the link”: convenient, but harder to trace and revoke. For customer projects with fixed partners, guests usually fit better; for a one-off download a short anonymous link with expiry can still make sense.
Personal consumer accounts mix work and private life. Where your Microsoft 365 plan allows it, we block those for guest access or collaboration so partners join with a work account. That is a practical choice, not a hard law — you weigh whether partners without a work account still exist.
More depth
Staff OneDrive versus SharePoint sites
OneDrive is often more personal; SharePoint sites are team or project spaces. Same organisation rules, but sites with customer data deserve stricter exceptions. Agree which libraries may go external at all.
Expiry and renewing links
A short default (for example days, not months) forces a fresh share when it is still needed. That is inconvenient — and exactly why old links disappear. A maximum expiry in admin stops “forever” links by habit.
Link to MFA and joiner/leaver
Guests and external links are access. Multi-factor authentication (MFA) for your own users stays; at offboarding we also review guest access and shared folders. See also our pieces on MFA in Microsoft 365 and the joiner and leaver checklist.