Control Default Sharing Link Settings for Sites and Documents with Sensitivity Labels

Build Organization-Wide Consistency in Sharing Behavior

Updated: February 24, 2022

Sensitivity label container management settings can control the sharing capability of SharePoint Online sites. Separately, the advanced settings of sensitivity labels can control the default sharing link settings for sites and documents. Enforcing consistent sharing capabilities is a good example of how container management through sensitivity labels make it easier to apply organizational standards across sites in a Microsoft 365 tenant.

Controlling Site Sharing

If you create a sensitivity label and configure it to apply a sharing capability of “Only people in your organization,” any site which receives the label automatically enforces that sharing capability. Site owners cannot change the sharing capability of a site without changing the label assigned to the site. Although tenant administrators can’t stop site owners changing a label, this is an auditable action which organizations can track to revert if necessary.

Controlling Default Sharing Link Settings

SharePoint Online creates sharing links when users share content from a site (Figure 1). The sharing link identifies what the person receiving the link can do with the content (read or edit). It also identifies who can use the link (anyone, specific people, tenant accounts).

SharePoint administrators can configure settings for the default sharing link for a site through PowerShell by running the Set-SPOSite cmdlet from the SharePoint Online management module. The relevant parameters are:

• DefaultSharingLinkType: Defines the default sharing link type for the site. For example, if this is “Internal,” the default sharing link type is set to anyone in the organization. The default is None, meaning respect the organization setting (defined with Set-SPOTenant).
• DefaultLinkPermission: Set to View or Edit to define what the link recipient can do. The default is None, meaning respect the organization setting.
• DefaultLinkToExistingAccess: The default is False. If set to True, the default sharing link type is set to People with existing access.

Defining a default sharing link type does not mean that site users are limited to the settings used to create sharing link. Users can update their sharing links to use other settings (for example, change the permission from edit to view), providing they remain within the constraints defined for the site’s external sharing capability.

Updating Sensitivity Labels with Default Sharing Link Settings

Now generally available (February 2022), you can configure the advanced settings of sensitivity labels to control the default sharing links generated for sites. The advantage of this method over configuring settings using Set-SPOSite is that any site assigned a label inherits the settings automatically. You don’t have to configure each site individually.

For now, configuration is by updating the advanced settings for a label with PowerShell. Given past practice, it’s possible that we will see a GUI for advanced label settings sometime in the future.

To update label settings, you connect to the compliance endpoint with PowerShell. Do this by running the Connect-IPPSession cmdlet from the Exchange Online management module. You can then use the Set-Label cmdlet to update the sensitivity labels. The setting names for Set-Label do not correspond exactly with the values used by Set-SPOSite. Here are the values:

• DefaultSharingScope (DefaultSharingLinkType) can be SpecificPeople, Organization, or Anyone.
• DefaultShareLinkPermission (DefaultLinkPermission) can be Edit or View.
• DefaultLinkToExistingAccess is True or False (default False).

You can update link settings separately or together. For example, these commands set the default sharing scope and permission in two steps:

Set-Label -Identity 'Guest Access' -AdvancedSettings @{DefaultSharingScope = "SpecificPeople"}
Set-Label -Identity 'Guest Access' -AdvancedSettings @{DefaultShareLinkPermission = "Edit"}

Or set the two values in one command:

Set-Label -Identity 'Non-Business Use' -AdvancedSettings @{DefaultShareLinkPermission = "Edit"; DefaultSharingScope = "Anyone"}

To check the settings for the label and confirm the configuration, run the Get-Label cmdlet:

Get-Label "Non-Business Use" | Select -ExpandProperty Settings
[contenttype, Site, UnifiedGroup]
[tooltip, Apply this label to a team, group, or site intended to support a non-business use such as a sports club or approved employee society.]
[displayname, Non-business use]
[defaultsharingscope, Anyone]
[defaultsharelinkpermission, Edit]

To set the default sharing link for the site so that it overrides any existing setting and uses people with existing access instead, run:

Set-Label -Identity 'Confidential Access' -AdvancedSettings @{DefaultLinkToExistingAccess  = "True"}

Like any other changes made to sensitivity labels, it can take up to 24 hours before SharePoint Online respects updates to the default sharing link settings.

Update Default Sharing Link Settings for Documents

Being able to control the default sharing link settings for sites by applying sensitivity labels is good. Being able to control default sharing link settings at a document level is even better. Microsoft added this capability between the preview and general availability. The same mechanism is used.

• Update a sensitivity label with default sharing link settings.
• Apply the sensitivity label to documents.
• If users share the labeled documents, SharePoint Online or OneDrive for Business use the settings from the label to generate the sharing link unless the site settings are more restrictive, in which case they take precedence.

The idea here is that you might have some specific documents in a site that you want people to pay attention to if they share the documents. The hope is that users will notice the differences in the sharing link generated by SharePoint Online or OneDrive for Business and recognize that they should be extra careful. The good thing is that people often accept default sharing link settings without question. The bad thing is that people mightn’t notice that a document is more confidential than the rest…

---

Keep up with the changing world of the Microsoft 365 ecosystem by subscribing to the Office 365 for IT Pros eBook. Monthly updates mean that our subscribers learn about new development as they happen.