Now that we have seen how sharing works in
SharePoint Online, let's start by learning
what settings we can configure at the
tenant level. The first setting is really
what is the most permissive levels that
users can share to? You've got four
options, and the first one and the most
permissive is anyone. This basically
allows users to share files using both
authenticated users and anonymous users.
Next up is new and existing users, which
allows users to share with external
authenticated accounts so inviting new
authenticated users to have access to
documents, sites, and so on, but not
allowing anonymous users in. The next one
that's a bit more restrictive is existing
guests only. This would allow external
guests that exist in your Azure Active
Directory either through Azure B2B or
other methods, but really an end user
cannot invite a new external user from
SharePoint without going through IT,
unless of course you have a custom
external user provisioning system, but we
won't really get into that in this course.
The last option and the most restrictive
one is only people in your organization,
which would block users from inviting any
sort of external user in SharePoint. Next
option, and this is really if you have
chosen to allow anonymous users, you can
have extra configuration options around
them. The first one is the maximum length
of time until an anonymous link expires.
This way you can set an expiration on how
long an anonymous link will work, but
let's say for example it cannot be longer
than seven days, because that's the cap
that you put at the tenant level. The next
option which I really like is setting the
maximum permissions for anonymous links.
So you can say that for example for files,
anonymous users can only view, but cannot
edit or you can allow them to view and
edit. You can also set the permissions for
folders, allowing anonymous users either
only view permissions on folders or view,
edit, and upload. The next possible
setting is which users can share outside
your organization. By doing this, you can
limit what users are allowed to share
externally, and you can do this at two
different levels. First of all, which
users are allowed to share with
authenticated external users, and then
another set of users that are allowed to
share with both authenticated and
anonymous users. What this really allows
you to do is to implement a way in which,
for example, users have to go through
training before being able to share
externally. Let's say that after level-one
training they're allowed to share with
authenticated users and after their
security or level-two training, they can
also share with anonymous. So as you can
see, even if you make the most permissive
level anonymous, there is lots of checks
that you can put in place to make sure
it's done within your organizational
standards. Another really useful setting
is the default link type. This is the link
type that's created by default when a user
clicks to share or copy a link so it
really looks at default behavior. The
choices are direct, internal, or anonymous
access. You can also set a default link
permission to either be view or view and
edit. If you look at the combination of
those settings, the most permissive one
would be for the default link to be
anonymous and with edit permissions, while
the most restrictive one would be direct
with view permissions only. You can also
limit external sharing by domain and
you've got two options. You can set it to
allow only specific domains, so really
kind of a white list. This would allow you
to, for example, have a known list of
partners and only be able to share with
those known partners. You could also block
specific domains. So basically you would
allow all of the domains, except the ones
you put on the list. A good example for
that is if you wanted to block all public
consumer addresses such as Hotmail,
Outlook, and so on, so people are forced
to share with the business email
addresses. It's important to remember that
those limitations of course do not apply
when a link of type anyone is created.
Some additional settings that we can
configure are for example, preventing
external users from sharing files,
folders, and sites that they do not own.
We can also force external users to accept
sharing invitations using the same account
that the invitation was sent to. You can
also force recipients to continuously
prove account ownership every X number of
days in order to make sure that they still
have access to that email address, and you
can also set a customized external sharing
policy URL that your users will see if
they try to share something, but they're
not allowed to. The last part before we go
into the demo are notifications. You can
configure SharePoint to add an email
address as Bcc on all of the external
sharing invitations so if you have a
security team that wants to be aware of
everything or you want to keep a log and
maybe automatically track them from that inbox, it's an option that you have.