SharePoint · OneDrive · Sharing links

The new sharing link in Microsoft 365: what changes in October 2026, and what stays exactly as overshared as before

Published 15 October 2026 · 6 min read · Message Center item quoted via a mirror, everything else from Microsoft Learn, linked at the end

Microsoft is rolling out a redesigned sharing dialog for files and folders. Each item gets one main link whose default audience is "Only people added to the file", so a link on its own grants nobody access until someone widens it. That is a narrower starting point than most tenants have today. It is also a change to what is created from now on. Nothing in the announcement touches the Anyone links and organisation-wide links that are already out there, and those are what Copilot and search can reach today.

What is changing

The details come from Message Center item MC1454378, "Microsoft 365: The Next Generation of File & Folder Sharing". We read it through the mc.merill.net mirror of Message Center, not through the admin centre, so check the wording in your own tenant's Message Center. As of its last update on 7 October 2026, the post says:

TopicWhat the post says
RolloutGeneral availability, worldwide and the US government clouds, from early October through the end of November 2026. The dates were revised on 7 October; the end moved out from late October
One main linkEach file or folder gets one primary link, which the post calls the "hero link", shown in the sharing dialog. Adding specific people directly works as it does today
Default audience"Only people added to the file": the link alone grants no one access
WideningThe person sharing can extend the link to people in the organisation or, where policy allows, to anyone with the link
Default permissionView. Users can choose view, edit, or view without downloading, depending on what they are allowed
Changing the audienceUpdates the existing link instead of creating a new one, so a sender can widen access without sending a new URL
Links that already existThey keep working and appear under "Other links" in the dialog. Existing default-link settings and link-expiration policies still apply to those legacy links, and do not govern the new main link
Admin controlA per-site default, DefaultMainLinkScope, with the values OnlyPeopleAdded (default) and Organization. The post says there is no tenant-wide setting
Action requiredNone before rollout. Microsoft suggests reviewing your sharing guidance, telling frequent cross-team and external collaborators, and checking site-level default sharing settings

The one control you get

Get-SPOSite -Identity https://TENANT.sharepoint.com/sites/finance | Select-Object Url, SharingCapability

# Default audience of the new main link for one site
Set-SPOSite -Identity https://TENANT.sharepoint.com/sites/finance -DefaultMainLinkScope Organization

The parameter is documented on the Set-SPOSite reference page, which lists -DefaultMainLinkScope <MainLinkAudience> in the syntax. Two limits from the post matter. First, it sets only the default: it does not stop a user from widening access when your sharing policy allows it. Second, it is per site, with no tenant switch, so a tenant with hundreds of sites that wants a different default has to script it.

One discrepancy to check before you plan around it. The post says the setting applies per site collection "or OneDrive", but the same Learn page lists a shorter set of valid parameters for OneDrive sites, and DefaultMainLinkScope is not in that list. We did not test it against a OneDrive site. Try it on one before you promise anyone a OneDrive default.

What stays exactly as it was

So the realistic reading is this: new sharing gets tidier over the coming months, while the backlog stays where it is. Whether the backlog matters depends on how many old links exist and what they point at, and Microsoft's own tooling already answers that.

A reasonable worry, stated as a worryLearn and the Message Center post do not say whether the "Other links" group will be easy for owners to review in bulk. That is a gap in what we could read, not a finding. Look at it in a test site before the rollout reaches your users.

Measuring the backlog

The data access governance reports in the SharePoint admin centre cover most of it. The sharing links reports list sites by the number of Anyone, "People in the organization" and "Specific people" links created in the last 28 days, and the Everyone except external users report finds the top sites where content was shared with the whole organisation in that window. The permission-state reports show the current picture across SharePoint and OneDrive. These need SharePoint Advanced Management, which a tenant gets once at least one user is assigned a Copilot licence. Without that, the activity-based reports need data collection switched on first, and then only contain data from that point.

The 28-day window is the limit to know about. The reports are good at what people shared recently and weak at what somebody shared in 2023. If you need every existing Anyone link with its path and expiry, or every site where Everyone except external users has access, that is a full inventory, not a 28-day window, and a read-only script does it without any licence.

Checklist for the rollout window

  1. Open a test site when the new dialog reaches your tenant. Share a file, widen the main link, and look at what "Other links" shows for an old link.
  2. Decide per site whether OnlyPeopleAdded or Organization is the right default. Document the sites where you change it.
  3. Test DefaultMainLinkScope on a OneDrive site before telling anyone it works there.
  4. Tell frequent external collaborators that a new link will open for nobody until the sender widens it. That is the change most likely to produce "I can't open it" tickets.
  5. Inventory what exists: Anyone links, organisation-wide links, Everyone except external users. The new default does not remove any of them.
  6. Review your link-expiration policies. They still govern the legacy links, and the post says they do not govern the new main link.

Free: every Anyone link and every site open to all employees, as two CSVs

ShareScout Lite is a read-only PowerShell audit. It prints a tenant summary and writes one CSV of every Anyone link (path, type, expiry) and one of every site where Everyone or Everyone except external users has access. It runs on any plan, with or without a Copilot licence, and nothing leaves your tenant.

Download ShareScout Lite — free See what Solo adds

Disclosure: ShareScout is our product. Dates and settings are from the Message Center post and Microsoft Learn as read on 15 October 2026; Microsoft has already revised the rollout dates once, so check the current text. Where this article reads between the lines, it says so. ShareScout is independent and not affiliated with or endorsed by Microsoft.

Sources