This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Download Microsoft Edge
More info about Internet Explorer and Microsoft Edge
While you can't disable internal sharing entirely or remove the Share button from sites, there are various ways that you can limit sharing in Microsoft 365 to meet the needs of your organization.
The methods of sharing files are listed in the following table. Select the link in the
Sharing method
column for detailed information.
Sharing method
Description
Limiting options
Microsoft 365 group or team
People granted access to a Microsoft Teams team or Microsoft 365 group have edit access to files in the associated SharePoint site.
If the group or team is private, sharing invitations to join the team go to the owner for approval. Admins can disable guest access or use sensitivity labels to prevent access by people from outside the organization. Admins can also limit sharing to members of the Microsoft 365 group or team.
SharePoint site
People can be granted Owner, Member, or Visitor access to a SharePoint site and will have that level of access to files in the site.
Site permissions can be restricted so that only site owners can share the site. Admins can limit site access and sharing to members of a security group, set a site to read-only, or block access entirely.
Sharing with specific people
Site members and people with edit permissions can give direct permissions to files and folders or share them by using
Specific people
links.
Site permissions can be restricted so that only site owners can share files and folders. In this case, direct access and
Specific people
link sharing by site members goes to site owner for approval.
OneDrive sharing
OneDrive owners can share files and folders with others.
Admins can limit access to OneDrive overall to people in a security group or limit access to shared files and folders in a specific OneDrive to people in a security group.
SharePoint and OneDrive guest sharing
SharePoint site owners and members and OneDrive owners can share files and folders with people outside the organization.
Guest sharing can be disabled for the entire organization or for individual sites.
People in your organization
sharing links
SharePoint site owners and members can share files using
People in your organization
links, which will work for anyone inside the organization.
People in your organization
links can be disabled at the site level.
Create sites, groups, and teams
By default, users can create new sites, groups, and teams from which they can share content.
Admins can restrict who can create sites, groups, and teams.
Email
People with access to a file can send it to others via email.
Admins can encrypt files by using sensitivity labels to prevent them being shared with unauthorized people.
Download or file copy
People with access to a file can download or copy it and share it with others outside the scope of Microsoft 365.
Admins can encrypt files by using sensitivity labels to prevent them being shared with unauthorized people.
You can also restrict the conditions under which people access shared content. See
conditional access
later in this article for more information.
While you can use the admin controls described in this article to limit sharing in your organization, we highly recommend that you consider using the security and compliance features available in Microsoft 365 to create a secure sharing environment. See
File collaboration in SharePoint with Microsoft 365
and
Configure Teams with three tiers of protection
for information.
To understand how sharing is being used in your organization, use
reports on file and folder sharing
and
data access governance reports
.
Microsoft 365 group or team
If you want to limit sharing in a Microsoft 365 group or Microsoft Teams team, it's important to make the group or team private. People inside your organization can join a public group or team anytime. Unless the group or team is private, there's no way to limit sharing of the team or its files within the organization.
Turn guest sharing off
If you want to prevent guest access in Teams, you can turn off guest sharing in the Teams admin center.
To turn off guest sharing for Teams
In the Teams admin center, expand
Users
>
Guest access
tab
.
Turn off
Guest access
.
Select
Save
.
If you want to prevent guest access in Microsoft 365 Groups, you can turn off the groups guest access settings in the Microsoft 365 admin center.
To turn off guest sharing in Microsoft 365 Groups
In the Microsoft 365 admin center, select
Settings
>
Org Settings
>
Services
tab
.
Select
Microsoft 365 Groups
.
Clear the
Let group owners add people outside your organization to Microsoft 365 Groups as guests
and
Let guest group members access group content
check boxes.
Select
Save
.
If you want to prevent guest sharing for a particular group or team, you can do so by using
Microsoft PowerShell
or
sensitivity labels
.
Limit guest sharing to specified domains
You can limit guest sharing to users from specific domains by allowing or blocking domains in Microsoft Entra ID. This also affects guest sharing in SharePoint if you have enabled
SharePoint and OneDrive integration with Microsoft Entra B2B
.
To allow sharing invitations only from specified domains
In the
Microsoft Entra admin center
, expand
External identities
, and then choose
External collaboration settings
.
Under
Collaboration restrictions
, select
Deny invitations to the specified domains
or
Allow invitations only to the specified domains
, and then type the domains that you want to use.
Select
Save
.
You can also use
Cross-tenant access settings
in Microsoft Entra ID to limit sharing to specific organizations. See
Limit guest sharing to specific organizations
for more information.
Limit access to members of the team or group
You can restrict access to SharePoint sites and content to users who are members of the Microsoft 365 group or team. Users outside the group or team won't have access to site content even if they have a sharing link. For more information, see
Restrict SharePoint site access to members of a group
.
SharePoint site
You can limit SharePoint site sharing to site owners only. This prevents site members from sharing the site. Keep in mind that if the site is connected to a Microsoft 365 group, group members can invite others to the group and those users will have site access.
To limit site sharing to owners
In the site, select the gear icon, and then select
Site permissions
.
Under
Sharing settings
, select
Change how members can share
.
Select
Site owners and members, and people with Edit permissions can share files and folders, but only site owners can share the site
.
Select
Save
.
You can prevent users who aren't members of the site from requesting access by turning off access requests.
To turn off access requests
In the site, select the gear icon, and then select
Site permissions
.
Under
Sharing settings
, select
Change how members can share
.
Turn off
Allow access requests
, and then select
Save
.
You can limit site sharing to specific domains by allowing or blocking domains for the site.
To limit site sharing by domain
In the SharePoint admin center, under
Sites
, select
Active sites
.
Select the site that you want to configure.
On the
Settings
tab, under
External file sharing
select
More sharing settings
.
Under
Advanced settings for external sharing
, select the
Limit sharing by domain
.
Add the domains that you want to allow or block, and then select
Save
.
Select
Save
.
Restrict access to members of a security group
You can restrict access to a SharePoint site and its contents to members of a security group. Users outside the group won't have access to site content even if they have a sharing link. For more information, see
Restrict SharePoint site access to members of a group
.
Block access to a site
You can block access to a site or make a site read-only by changing the lock state of the site. For details, see
Lock and unlock sites
.
Permissions inheritance
While not recommended, you can use
SharePoint permissions inheritance
to customize access levels to sites and subsites.
Sharing with specific people
if you want to limit the sharing of a site or its contents, you can configure the site to only allow site owners to share files, folders, and the site. When this is configured, site members' attempts to share files or folders by using
Specific people
links go to the site owner for approval.
To limit site, file, and folder sharing to owners
In the site, select the gear icon, and then select
Site permissions
.
Under
Sharing settings
, select
Change how members can share
.
Select
Only site owners can share files, folders, and the site
.
Select
Save
.
OneDrive sharing
Admins can limit access to OneDrive overall to people in a security group or limit access to shared files and folders in a specific OneDrive to people in a security group.
You can restrict access and sharing of OneDrive content throughout your organization to users in a security group. Even if other users outside of these security groups are licensed for OneDrive, they won’t have access to their own OneDrive or any shared OneDrive content when this policy is in effect. For more information, see
Restrict OneDrive access by security group
.
You can restrict access to an individual user's OneDrive content to users in a security group by using a OneDrive access restriction policy. Users not in the specified group can't access the content, even if they had prior permissions or shared link. For more information, see
Restrict access to a user's OneDrive content to people in a group
.
SharePoint and OneDrive guest sharing
If you want to prevent sharing SharePoint or OneDrive files and folders with people outside your organization, you can turn off guest sharing for the entire organization or for an individual site.
To turn off SharePoint guest sharing for your organization
In the SharePoint admin center, under
Policies
, select
Sharing
.
Under
External sharing
, drag the SharePoint slider down to
Only people in your organization
. (The OneDrive slider is dependent on SharePoint and will also be set to
Only people in your organization
.)
Select
Save
.
To turn off guest sharing for a site
In the SharePoint admin center, under
Sites
, select
Active sites
.
Select the site that you want to configure.
On the
Settings
tab, under
External file sharing
, choose
Only people in your organization
from the dropdown list.
Select
Save
.
You can turn off guest sharing for an individual OneDrive by selecting the user in the Microsoft 365 admin center and selecting
Manage external sharing
on the
OneDrive
tab.
If you would like to allow sharing with people outside your organization but you want to make sure that everyone authenticates, you can disable
Anyone
(anonymous sharing) links for the entire organization or for an individual site.
To turn off
Anyone
links at the organization level
In the SharePoint admin center, under
Policies
, select
Sharing
.
Under
External sharing
, drag the SharePoint slider down to
New and existing guests
. (The OneDrive slider is dependent on SharePoint and will also be set to
New and existing guests
.)
Select
Save
.
To turn off
Anyone
links for a site
In the SharePoint admin center, under
Sites
, select
Active sites
.
Select the site that you want to configure.
On the
Settings
tab, under
External file sharing
, choose
New and existing guests
from the dropdown list.
People in your organization
sharing links
By default, members of a site can share files and folders with other people in your organization by using a
People in your organization
link. You can disable
People in your organization
links by using PowerShell:
Set-SPOSite -Identity <site> -DisableCompanyWideSharingLinks Disabled
For example:
Set-SPOSite -Identity https://contoso.sharepoint.com -DisableCompanyWideSharingLinks Disabled
Note that if you disable People in your organization links, people sharing files in the site may need to use Specific people links, which can be shared with a maximum of 50 people.
Create sites, groups, and teams
By default, users can create new sites, groups, and teams from which they may be able to share content (depending on your sharing settings). You can restrict who can create sites, groups, and teams. See the following references:
Manage site creation in SharePoint
Manage who can create Microsoft 365 Groups
Restricting group creation restricts team creation.
Email
You can prevent unwanted sharing of emails by using encryption. This prevents emails being forwarded or otherwise shared with unauthorized users. Email encryption can be enabled by using sensitivity labels. See Restrict access to content by using sensitivity labels to apply encryption for details.
Download or file copy
Users who have access to files and folders in Microsoft 365 can download files and copy them to external media. To reduce the risk of unwanted file sharing, you can encrypt the content by using sensitivity labels. Users can also block file download when they share files
Conditional access
Microsoft Entra Conditional Access provides options to limit or prevent sharing with people based on network location, device health, sign-in risk, and other factors. See What is Conditional Access?.
SharePoint provides direct integration with Microsoft Entra Conditional Access for both unmanaged devices and network location. See the following references for details:
SharePoint and OneDrive unmanaged device access controls
Control access to SharePoint and OneDrive data based on network location
Related articles
Limit who can invite guests
Microsoft 365 guest sharing settings reference
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for
This product
