M365 Next-Gen Sharing: Secure by Default, Governed by Design

Microsoft 365's new sharing experience marks a significant evolution in how files and folders are shared, moving to a fundamentally "secure by default" posture. For M365 and Intune engineers, grasping this paradigm shift is crucial for implementing robust data governance, streamlining external collaboration, and ensuring compliance across the organization. This update is deeply integrated with Entra ID (formerly Azure AD), Microsoft Purview, and granular SharePoint Online controls, empowering administrators with unprecedented control while simplifying the user experience.

The Big Picture: M365 Next-Gen Sharing Architecture

At its core, the next-gen sharing experience weaves together several critical Microsoft 365 services to create a unified and highly governable collaboration framework. Entra ID provides the identity backbone, Purview enforces data loss prevention (DLP) and sensitivity labels, and SharePoint Online acts as the primary content repository with enhanced sharing controls. This architecture ensures that sharing policies are applied consistently, regardless of where the sharing originates.

Concept Primer: Secure by Default

The most impactful change in the next-gen sharing experience is the shift from a potentially open default to a "secure by default" model. Previously, it was common for SharePoint Online tenants to have "Anyone with the link" sharing enabled by default, often leading to unintended broad access. The new approach prioritizes internal collaboration and explicit external sharing, drastically reducing the risk of accidental data exposure.

Sharing Link Types: A Granular Approach

The new sharing experience puts a stronger emphasis on understanding and utilizing the different link types available. Each type offers distinct levels of security and access control, making it critical for administrators to configure appropriate tenant and site-level defaults, and for users to select the right option for their sharing needs.

Step-by-Step: Configuring Tenant-Wide Sharing Defaults

As an M365 engineer, your primary control point for next-gen sharing is the SharePoint Admin Center. Here, you can define the default sharing link type and permissions, as well as external sharing capabilities for your entire tenant. These settings cascade down to sites and individual files, though site owners can often configure stricter policies.

1. Access SharePoint Admin Center

   Navigate to the SharePoint Admin Center and locate the "Sharing" settings. This is where you'll define the overarching external sharing capabilities for your organization.

   https://admin.microsoft.com
     → Show all
     → SharePoint
     → Policies
     → Sharing

2. Set External Sharing Level

   Choose the most restrictive external sharing level that still meets your business needs. For "secure by default," this often means limiting "Anyone" links or disabling them entirely.

   • Anyone: Files and folders can be shared using links that don't require sign-in. (Least secure)
   • New and existing guests: Guests must sign in or provide a verification code.
   • Existing guests only: Only guests already in your organization's directory.
   • Only people in your organization: No external sharing allowed. (Most secure)
   Recommendation: For most organizations, "New and existing guests" is a balanced default, allowing controlled external collaboration. Avoid "Anyone" unless absolutely necessary and with strict controls.

3. Configure Default Link Type

   This is a critical setting for the "secure by default" model. Set the default sharing link to "Specific people" or "People in your organization" to ensure that users explicitly choose broader access if needed.

   // In SharePoint Admin Center > Sharing settings
   Default link type:
     ○ Specific people // Recommended for secure by default
     ○ Only people in your organization
     ○ Anyone with the link // Avoid unless specific business need
   
   Default link permission:
     ○ View
     ○ Edit

4. Implement PowerShell for Granular Control

   For advanced or automated configuration, use SharePoint Online PowerShell. The Set-SPOTenant cmdlet is your friend.

   # Connect to SharePoint Online Admin Service
   Connect-SPOService -Url https://yourtenant-admin.sharepoint.com
   
   # Set tenant-wide external sharing to 'New and existing guests'
   Set-SPOTenant -SharingCapability ExternalUserAndGuestSharing
   
   # Set default sharing link type to 'Specific People'
   Set-SPOTenant -DefaultSharingLinkType Direct # 'Direct' maps to Specific people
   
   # Set default sharing link permission to 'View'
   Set-SPOTenant -DefaultSharingLinkToExistingAccess View

What's New: Purview Integration for Contextual Governance

A significant enhancement in next-gen sharing is the deeper integration with Microsoft Purview. Sensitivity labels, configured in Purview, can now directly influence sharing options, enforcing policies based on the content's classification. This means a document marked "Confidential" can automatically restrict sharing to "Specific people" only, regardless of tenant defaults.

Key SharePoint Online Sharing Properties

Understanding the various SharePoint Online properties related to sharing is essential for fine-tuning your tenant's collaboration posture. These settings can be configured at the tenant level and, in some cases, overridden or further restricted at the site collection level.

Permissions and Licensing Requirements

To effectively manage and configure M365 Next-Gen Sharing, specific administrative roles and licensing are required. Incorrect permissions can lead to configuration silos or security gaps.

Use Cases: Why This Matters for Your Organization

The "secure by default" sharing model isn't just about security; it's about enabling safer, more efficient collaboration. By understanding and implementing these changes, organizations can achieve several key benefits:

Best Practices & Governance Implementation Roadmap

Modernizing external sharing in Microsoft 365 is not merely about disabling anonymous links—it requires an intentional, multi-layered architecture combining SharePoint, OneDrive, Teams, and Microsoft Purview:

Summary & Key Takeaways for Administrators

By transitioning from reactive link cleanups to a modern "Secure by Default, Governed by Design" framework, organizations achieve high-velocity collaboration without sacrificing corporate data sovereignty.