🎯 Purpose
✅ Remove anonymous sharing links, block legacy authentication and stop guests re‑sharing content in SharePoint Online and OneDrive.
➡️ Keeps shared content tied to known, authenticated identities that Conditional Access and MFA can protect.
👥 Who is affected
✅ Users: All users and guests accessing SharePoint Online and OneDrive
🚫 Exclusions: None (tenant‑wide settings)
☁️ What is protected
✅ SharePoint sites, Teams files and OneDrive content
✅ Type: SharePoint admin center tenant settings
🔐 How sharing and authentication are controlled
Setting | Value |
External sharing (SharePoint and OneDrive) | New and existing guests (was Anyone) |
Apps that don't use modern authentication (legacy authentication protocols) | Blocked (was allowed) |
Allow guests to share items they don't own (external users can reshare) | Disabled (was enabled) |
➡️ Every external share requires the guest to sign in. Legacy clients that bypass Conditional Access and MFA can no longer connect.
ℹ️ Note: Existing Anyone links stop working when external sharing is changed to New and existing guests. Tell users before deploying.
⚙️ What this policy does NOT enforce
🚫 Restricting OneDrive sync to domain‑joined devices. Left off because it would block Entra ID‑joined devices.
🚫 Sensitivity labels or DLP
🚫 Domain allow/deny lists for sharing
🚫 Idle session sign‑out (configured separately)
🟢 Policy status
✅ Enabled
✅ Applies tenant‑wide
📘 Essential Eight Alignment
✅ Blocking legacy authentication supports Essential Eight – Multi‑factor Authentication, because legacy protocols cannot enforce MFA
ℹ️ Inforcer Best Practice control applied at all maturity levels
📘 Practical Interpretation (Executive‑Friendly)
These settings ensure that:
✅ Company files can't be shared through anonymous "anyone with the link" URLs
✅ Guests can't pass files on to other people
✅ Old apps that skip MFA can't access SharePoint or OneDrive