We have now entered the theory of what we
can configure, let's go to the demo
environment and configure external sharing
settings at the tenant level. We are now
in the demo environment and let me open up
the browser here where I am in the
SharePoint Online admin center. Now in
order to go to the tenant sharing
settings, we have to go under Policies to
Sharing. Now something to be aware of is
that as I have mentioned previously in
this course is that as I'm recording this,
SharePoint Online is somewhere between the
new admin center and the old one, and for
external sharing settings, most of the
features have made it to the new admin
center, but we're still going to have to
go to the old admin center for other
settings. Let's start with what is the
most permissive setting that you want to
have for content? Do you want anyone, new
and existing guest, existing guest, or
close down external sharing completely and
keep it to only people in your
organization? Now I'll tell you guys a
funny story that is something that I find
both funny and ashamed of myself just
because I use PowerShell a lot to
configure those settings. For at least a
few months I thought that this whole
square here was only a picture just to
give an idea of what it looks like most
permissive to the least permissive.
However, it turns out that you can
actually play with them and those are how
the settings are configured. So you can
change the settings here for both
SharePoint and OneDrive for Business, and
something that you need to be aware of,
and I know this is a SharePoint Online
course, but this is so close with OneDrive
for Business is that the OneDrive for
Business cannot be more permissive than
the SharePoint ones. So as I drag this one
lower, you'll see that the OneDrive for
Business one will also be dragged lower.
And as I raise the SharePoint one, I can
also raise the OneDrive for Business one.
So really, if you want to have different
settings between SharePoint and OneDrive
for Business, the SharePoint ones need to
be more permissive. So let's leave it at
anyone for now and for OneDrive for
Business we're going to put it to anyone
as well. Now scrolling down, let's go into
the advanced settings. Do we want to limit
external sharing by domain? Let's say that
we do, and here I can add domains. After
the pop-up opens, I have the option to
allow only specific domains or block
specific domains. I cannot have both of
them so I cannot allow domain 1, domain 2,
and domain 3 and block another one. So
it's really one or the other. So let's say
that we're going to allow only specific
domains, and we're going to do
globomantics.org, pluralsight.com, and
we're also going to add contoso.com in
here. Let's click on OK, and you see they
have been added. Now one that is not
turned on by default, but I always
recommend that you do is guests must sign
in using the same account to which sharing
invitations were sent. This forces people
that you invite them with vlad@
globomantics.com. Well, they're going to
have to sign in with vlad@
globomantics.com ; they're not going to be
able to use other Microsoft accounts such
as their Hotmail one. And also, do I want
to allow guests to share items that they
do not own? We're going to put it at no.
Next up, let's take a look at the links.
First of all, what is the link that is
selected by default? Specific people, only
people in your organization, or anyone
with the link. Let's put it to specific
people so only, so by default the user
that shares has to specify somebody for
that share to be done. It cannot just
copy, copy, like click, copy/paste, and
make it work. Now the advanced settings
for the anonymous links. I can set the
limit so I can say that anonymous links
must expire in maximum three days. This
way users cannot make anonymous links that
last forever, and I can also restrict for
files if anonymous links can view or edit
or only view, and for folders if they can
view or view, edit, and upload. Let's put
it at view as well. Now you can see that
for other settings we have to go to the
classic sharing page, and whatever one we
click out of those two options, it will
bring us to the same spot. So let's go to
the see the rest of the settings in the
classic page. A lot of the settings will
be the same so sharing outside of the
organization. You see we have the same
settings. Something that is really
important is that we haven't clicked Save
yet on this one so that's why the changes
will not be seen in this view. We need to
click Save on the other one before it's
visible. Now let's talk about who can
share outside of your organization. I can
let only users and selected security
groups share with authenticated external
users, and let users in selected security
groups share with authenticated external
users and using anonymous links. So now if
a site is configured to be able to
anonymous links; however, I have this set
up, only people inside the group will be
able to do it. If my site is configured to
only allow sharing with logged-in users
and I have people that are allowed to
share anonymous, the maximum is still
logged-in users. So this does not open any
loophole. It simply filters down even more
on who can share inside. Now I have the
default link type, default link
permissions that we have looked at as
well. In that case we would have
configured it to direct and view, and now
also additional settings, again limit
external sharing using domains, prevent
external users from. Something that just
happened here is once you click on a
checkbox, it will actually bring you back
to the top because depending on what you
click, you're not going to see the same
things. So it happened to me on video so
I'll just do it again so that you see it.
I will click here. It brings me back to
the top and then I can configure it. If I
unclick it, it will again bring me back to
the top as the page refreshes. So I always
forget on which one it does it; that's why
it took me a bit by surprise, but don't
worry. Sometimes as you change certain
settings, it will bring you back to the
top and it will hide certain things. Like
if I click don't allow sharing outside
your organization, it will hide all of the
sharing settings that cannot be done. If I
do anonymous, they will appear back. Other
settings about notifications are, do you
want to email, and this is really about
OneDrive for Business; do you want to
email OneDrive for Business owners when
other users invite additional external
users to shared files. External users
accept invitations to access files, and
anonymous access link is created or
changed. You will have noticed that some
of the settings in the slides we have not
seen in the new admin center or the
classic one, and this is because they're
PowerShell only. Those settings are the
copying somebody as a Bcc or a shared
mailbox on every single invitation, and
this needs to be done using PowerShell
using the Set-SPOTenant,
-BccExternalSharingInvitations $true, and
-BccSharingInvitationList, which is a
comma-separated list of emails that need
to be copied. You can also set the
-CustomizedExternalSharingServiceUrl,
which is the link that is proposed to
users when they try to share something,
but they're not allowed to. So feel free
to put the URL of your sharing governance
policy or where they can reach out to IT
when this happens. This it for configuring
tenant settings. Now that we have seen how
to configure external sharing at the
tenant level, let's take a look at how to do it at the site level.