Support for Sharing Links Expiration Added for Company-wide and Specific People Links

The change announced in message center notification MC799277 (6 June 2024) to make expiration dates available for all types of sharing links should now have reached targeted release tenants. General availability will follow soon afterwards.

Until now, SharePoint Online and OneDrive for Business have supported expiration dates for anyone sharing links. Microsoft was correct to start with these links because they are transferable. In other words, anyone in possession of the link can access the file or folder pointed to by the link.

Although anyone links are revocable and therefore can be annulled if a link becomes too widely available, making them the first sharing link to support expiration was a good thing. Even with expiration dates, many organizations prohibit anyone links because they consider these links to be too dangerous. Users forget to set expiration dates, the links circulate in email and can easily escape outside the organization, and so on.

Company-wide and Specific People Sharing Links

Company-wide (aka people in your organization) and specific people links deliver tighter control over sharing because SharePoint Online validates the account that attempts to redeem and use a link to make sure that they meet the sharing criteria. For example, if you’re not signed into a tenant account, SharePoint Online won’t allow you to use a company-wide link.

Specific people links are usable with people inside and outside an organization. External people must have a guest account in the tenant to authenticate, either an account created to access other resources like Teams (or most recently, Microsoft Loop), or an account created during the process of gaining access to the shared content. During this process, depending on the conditional access policies active in the tenant, an external person might be asked to configure multi-factor authentication to protect their account.

All of this sounds good, and it means that specific people links are usually a safe way to share externally, especially if coupled with a sensitivity label with encryption to stop any inadvertent leakage of confidential information.

Sharing Links Expiration for All

Using a sharing link that SharePoint Online imposes controls over who can use the link can sometimes do with a little extra help and that’s where the expiration controls come in. You can now set a date (Figure 1) for company-wide and specific people sharing links to expire.

When a link expires, it can no longer be used to access the shared content. The owner of the content must then reshare the content if they wish.

It seems like Microsoft has some loose ends to clean up before you could consider this feature to be complete. For instance, although SharePoint Online shows the expiration date after copying a link (Figure 2), the Manage access dialog for an item doesn’t display expiration dates. This might be due to an incomplete software deployment and the missing bits for an updated Manage access dialog might be still on the way.

More importantly, the SharePoint Online admin center has a setting for Anyone links to set a maximum expiration length in days (Figure 3). However, similar controls aren’t yet available for company-wide and specific people links. That seems like an oversight.

Being picky, I could also point out that setting an expiration period for a sharing link does not affect the SharingSet audit record generated when SharePoint Online or OneDrive for Business configure a sharing link. This is a pity. Microsoft needs to improve the information captured in audit records for sharing events to make them more administrator friendly. For instance, a value like “EventData    : <PermissionsGranted>Contribute</PermissionsGranted><MembersCanShareApplied>False</MembersCanShareApplied>” is meaningful to a computer but less so to a human. If you’re interested in learning how to interpret audit records for sharing events, try this script from GitHub.

Sharing Links Expiration for All Link Types is a Good Change

Even though I think Microsoft has some things to work on to complete the feature, I like that SharePoint Online supports expiration dates for all types of sharing links. It’s a good change and one that should be popular with users, even if administrators can’t find out the kind of usage the feature gets because of the lack of detail in audit records. According to MC799277, Microsoft is due to refresh the documentation, but that hasn’t happened yet. More bits lost in transit!

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.