Skip to content

SPOSharingSettings

Parameters

Parameter Attribute DataType Description Allowed Values
IsSingleInstance Key String Specifies the resource is a single instance, the value must be 'Yes' Yes
AllowGuestUserShareToUsersNotInSiteCollection Write Boolean The AllowGuestUserShareToUsersNotInSiteCollection settings (defaulted to false) will allow guests to share to users not in the site.
AllowSharingOutsideRestrictedAccessControlGroups Write Boolean Controls whether sharing SharePoint sites and their content is allowed with users and groups who are not allowed as per the Restricted access control policy.
CoreDefaultShareLinkRole Write String Sets the default sharing link role for SharePoint sites. It replaces the DefaultLinkPermission. Valid values are: None, View, Edit, Review, RestrictedView. None, View, Edit, Review, RestrictedView
CoreDefaultShareLinkScope Write String Sets the default sharing link scope for SharePoint sites. It replaces the DefaultSharingLinkType. The valid values are: Anyone, Organization, SpecificPeople, Uninitialized Anyone, Organization, SpecificPeople, Uninitialized
SharingCapability Write String Configures sharing capability for SharePoint ExistingExternalUserSharingOnly, ExternalUserAndGuestSharing, Disabled, ExternalUserSharingOnly
MySiteSharingCapability Write String Configures sharing capability for mysite (onedrive) ExistingExternalUserSharingOnly, ExternalUserAndGuestSharing, Disabled, ExternalUserSharingOnly
ShowEveryoneClaim Write Boolean Enables the administrator to hide the Everyone claim in the People Picker.
ShowAllUsersClaim Write Boolean Enables the administrator to hide the All Users claim groups in People Picker.
ShowEveryoneExceptExternalUsersClaim Write Boolean Enables the administrator to hide the Everyone except external users claim in the People Picker.
ProvisionSharedWithEveryoneFolder Write Boolean Creates a Shared with Everyone folder in every user's new OneDrive for Business document library.
EnableGuestSignInAcceleration Write Boolean Accelerates guest-enabled site collections as well as member-only site collections when the SignInAccelerationDomain parameter is set.
GuestSharingGroupAllowListInTenantByPrincipalIdentity Write String[] Sets the guest sharing group allow list in the tenant by principal identity.
OneDriveLoopSharingCapability Write String When sharing a whiteboard in a Teams meeting, Whiteboard creates a sharing link that's accessible by anyone within the organization and automatically shares the whiteboard with any in-tenant users in the meeting. The valid values are: ExternalUserAndGuestSharing, Disabled, ExternalUserSharingOnly, ExistingExternalUserSharingOnly ExistingExternalUserSharingOnly, ExternalUserAndGuestSharing, Disabled, ExternalUserSharingOnly
OneDriveLoopDefaultSharingLinkScope Write String Gets or sets default share link scope for fluid on OneDrive sites. The valid values are: Anyone, Organization, SpecificPeople, Uninitialized Anyone, Organization, SpecificPeople, Uninitialized
OneDriveLoopDefaultSharingLinkRole Write String Gets or sets default share link role for fluid on OneDrive sites. Valid values are: None, View, Edit, Review, RestrictedView. None, View, Edit, Review, RestrictedView
CoreLoopSharingCapability Write String Gets or sets collaboration type for fluid on core partition. The valid values are: ExternalUserAndGuestSharing, Disabled, ExternalUserSharingOnly, ExistingExternalUserSharingOnly ExistingExternalUserSharingOnly, ExternalUserAndGuestSharing, Disabled, ExternalUserSharingOnly
CoreLoopDefaultSharingLinkScope Write String Gets or sets default share link scope for fluid on SharePoint sites. The valid values are: Anyone, Organization, SpecificPeople, Uninitialized Anyone, Organization, SpecificPeople, Uninitialized
CoreLoopDefaultSharingLinkRole Write String Gets or sets default share link role for fluid on SharePoint sites. Valid values are: None, View, Edit, Review, RestrictedView. None, View, Edit, Review, RestrictedView
CoreDefaultLinkToExistingAccess Write Boolean Gets or sets default share link to existing access on core partition.
OneDriveDefaultShareLinkScope Write String Sets the default sharing link scope for OneDrive. The valid values are: Anyone, Organization, SpecificPeople, Uninitialized Anyone, Organization, SpecificPeople, Uninitialized
OneDriveDefaultShareLinkRole Write String Sets the default sharing link role for OneDrive. It replaces the DefaultSharingLinkType. Valid values are: None, View, Edit, Review, RestrictedView. None, View, Edit, Review, RestrictedView
OneDriveDefaultLinkToExistingAccess Write Boolean Sets whether OneDrive default links should grant access to existing users. It replaces the DefaultLinkPermission.
WhoCanShareAllowListInTenant Write String[] Sets a value to handle the tenant who can share settings.
WhoCanShareAllowListInTenantByPrincipalIdentity Write String[] Principal identities allowed to share content at the tenant level.
OneDriveOrganizationSharingLinkMaxExpirationInDays Write SInt32 Specifies the maximum number of days before organization sharing links expire for all OneDrive sites. This is a tenant wide setting, and all geos will inherit the policy. The value can be from 7 to 720 days. To remove the expiration requirement, set the value to zero (0).
OneDriveOrganizationSharingLinkRecommendedExpirationInDays Write SInt32 Specifies the recommended number of days before organization sharing links expire for all OneDrive sites. This setting provides a suggested expiration period to users when they create sharing links. This is a tenant wide setting, and all geos will inherit the policy. The value can be from 7 to 720 days and must be less than or equal to the maximum expiration value set by OneDriveOrganizationSharingLinkMaxExpirationInDays. When set to 0, the default value will be OneDriveOrganizationSharingLinkMaxExpirationInDays.
RestrictExternalSharing Write String[] Sets the list of agentic identities that are restricted from sharing content to external users. Pass the full set of GUIDs that should remain restricted, or @() to clear the list.
BccExternalSharingInvitations Write Boolean When the feature is enabled, all external sharing invitations that are sent will blind copy the e-mail messages listed in the BccExternalSharingsInvitationList.
BccExternalSharingInvitationsList Write String Specifies a list of e-mail addresses to be BCC'd when the BCC for External Sharing feature is enabled.Multiple addresses can be specified by creating a comma separated list with no spaces.
CoreOrganizationSharingLinkMaxExpirationInDays Write SInt32 This parameter specifies the maximum number of days that organization sharing links can remain active before they expire for all SharePoint sites (not including OneDrive sites). This is a tenant wide setting, and all geos will inherit the policy. The valid values : - can be from 7 to 730 days. - 0 (default) - No maximum expiration limit is enforced.
CoreOrganizationSharingLinkRecommendedExpirationInDays Write SInt32 This parameter specifies the recommended number of days before organization sharing links expire in SharePoint sites (not including OneDrive sites). Users can still choose a different expiration period if permitted by policy, but this value is presented as the recommended default. This is a tenant wide setting, and all geos will inherit the policy. The valid values : - Can be from 7 to 730 days and must be less than or equal to the maximum expiration value set by CoreOrganizationSharingLinkMaxExpirationInDays. - When set to 0 (default), the default value will be CoreOrganizationSharingLinkMaxExpirationInDays.
RestrictExternalSharingForAgents Write Boolean This parameter controls whether external sharing is restricted for agents. The valid values are: - False (default) - Agents can share content externally according to existing sharing policies. - True - External sharing for agents is restricted.
RequireAnonymousLinksExpireInDays Write SInt32 Specifies all anonymous links that have been created (or will be created) will expire after the set number of days.
SharingAllowedDomainList Write String[] Specifies a list of email domains that is allowed for sharing with the external collaborators. Entry values as an array of domains.
SharingBlockedDomainList Write String[] Specifies a list of email domains that is blocked or prohibited for sharing with the external collaborators. Entry values as an array of domains.
SharingDomainRestrictionMode Write String Specifies the external sharing mode for domains. None, AllowList, BlockList
DefaultSharingLinkType Write String Lets administrators choose what type of link appears is selected in the 'Get a link' sharing dialog box in OneDrive for Business and SharePoint Online None, Direct, Internal, AnonymousAccess
PreventExternalUsersFromResharing Write Boolean Allow or deny external users re-sharing
ShowPeoplePickerSuggestionsForGuestUsers Write Boolean Enables the administrator to hide the guest users claim in the People Picker.
FileAnonymousLinkType Write String Configures anonymous link types for files View, Edit
FolderAnonymousLinkType Write String Configures anonymous link types for folders View, Edit
NotifyOwnersWhenItemsReshared Write Boolean When this parameter is set to $true and another user re-shares a document from a user's OneDrive for Business, the OneDrive for Business owner is notified by e-mail.
DefaultLinkPermission Write String Specifies the link permission on the tenant level. Valid values to set are View and Edit. A value of None will be set to Edit as its the default value. None, View, Edit
Ensure Write String Only accepted value is 'Present'. Present, Absent
Credential Write PSCredential Credentials of the account to authenticate with.
ApplicationId Write String Id of the Azure Active Directory application to authenticate with.
ApplicationSecret Write PSCredential Secret of the Azure Active Directory application to authenticate with.
TenantId Write String Name of the Azure Active Directory tenant used for authentication. Format contoso.onmicrosoft.com
CertificateThumbprint Write String Thumbprint of the Azure Active Directory application's authentication certificate to use for authentication.
CertificatePassword Write PSCredential Username can be made up to anything but password will be used for CertificatePassword
CertificatePath Write String Path to certificate used in service principal usually a PFX file.
ManagedIdentity Write Boolean Managed ID being used for authentication.
ExternalUserExpirationRequired Write Boolean Enable Guest access to a site or Onedrive to expire after
ExternalUserExpireInDays Write SInt32 Specifies Number of days for Guest Access links to expire.
AccessTokens Write String[] Access token used for authentication.

Description

This resource allows users to configure and monitor the sharing settings for your SPO tenant sharing settings

Permissions

Graph

To authenticate with the Graph API, this resource requires the following permissions:

Delegated permissions

  • Read

  • Domain.Read.All

  • Update

  • Domain.Read.All

Application permissions

  • Read

  • Domain.Read.All

  • Update

  • Domain.Read.All

Sharepoint

To authenticate with the Sharepoint API, this resource requires the following permissions:

Delegated permissions

  • Read

  • Sites.FullControl.All

  • Update

  • Sites.FullControl.All

Application permissions

  • Read

  • Sites.FullControl.All

  • Update

  • Sites.FullControl.All

Examples

Example 1

This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.

Configuration Example
{
    param
    (
        [Parameter()]
        [System.String]
        $ApplicationId,

        [Parameter()]
        [System.String]
        $TenantId,

        [Parameter()]
        [System.String]
        $CertificateThumbprint
    )

    Import-DscResource -ModuleName Microsoft365DSC

    Node localhost
    {
        SPOSharingSettings 'SPOSharingSettings-Example'
        {
            IsSingleInstance                                           = "Yes"
            AllowGuestUserShareToUsersNotInSiteCollection              = $false
            AllowSharingOutsideRestrictedAccessControlGroups           = $true
            SharingCapability                                          = "ExternalUserSharingOnly"
            MySiteSharingCapability                                    = "ExistingExternalUserSharingOnly"
            CoreDefaultShareLinkScope                                  = "SpecificPeople"
            CoreDefaultShareLinkRole                                   = "View"
            CoreDefaultLinkToExistingAccess                            = $false
            CoreLoopSharingCapability                                  = "ExternalUserSharingOnly"
            CoreLoopDefaultSharingLinkScope                            = "SpecificPeople"
            CoreLoopDefaultSharingLinkRole                             = "View"
            CoreOrganizationSharingLinkMaxExpirationInDays             = 180
            CoreOrganizationSharingLinkRecommendedExpirationInDays     = 90
            OneDriveDefaultShareLinkScope                              = "SpecificPeople"
            OneDriveDefaultShareLinkRole                               = "View"
            OneDriveDefaultLinkToExistingAccess                        = $false
            OneDriveLoopSharingCapability                              = "ExternalUserSharingOnly"
            OneDriveLoopDefaultSharingLinkScope                        = "SpecificPeople"
            OneDriveLoopDefaultSharingLinkRole                         = "View"
            OneDriveOrganizationSharingLinkMaxExpirationInDays         = 180
            OneDriveOrganizationSharingLinkRecommendedExpirationInDays = 90
            ShowEveryoneClaim                                          = $false
            ShowAllUsersClaim                                          = $false
            ShowEveryoneExceptExternalUsersClaim                       = $true
            ProvisionSharedWithEveryoneFolder                          = $false
            EnableGuestSignInAcceleration                              = $false
            GuestSharingGroupAllowListInTenantByPrincipalIdentity      = @()
            WhoCanShareAllowListInTenant                               = @()
            WhoCanShareAllowListInTenantByPrincipalIdentity            = @()
            RestrictExternalSharing                                    = @()
            RestrictExternalSharingForAgents                           = $false
            BccExternalSharingInvitations                              = $true
            BccExternalSharingInvitationsList                          = "compliance@contoso.com"
            SharingDomainRestrictionMode                               = "None"
            DefaultSharingLinkType                                     = "Direct"
            DefaultLinkPermission                                      = "View"
            PreventExternalUsersFromResharing                          = $false
            ShowPeoplePickerSuggestionsForGuestUsers                   = $false
            NotifyOwnersWhenItemsReshared                              = $true
            ExternalUserExpirationRequired                             = $false
            ApplicationId                                              = $ApplicationId
            TenantId                                                   = $TenantId
            CertificateThumbprint                                      = $CertificateThumbprint
        }
    }
}