Published: June 2026. Source: Microsoft 365 Message Center MC1242772 / Office 365 for IT Pros
Until now, SharePoint Online administrators could set expiration dates on anonymous ("Anyone with the link") sharing links and on specific-person sharing links, but "People in your organization" links were left out: they never expired by default, regardless of how long ago they were created. Microsoft's Message Center notification MC1242772 closes that gap. Rolling out from March 2026 through late June 2026, this update gives administrators the ability to enforce expiry policies on internal org-wide sharing links across both SharePoint Online and OneDrive for Business.
What Is the 'People in Your Organization' Sharing Link Expiry Policy?
The update adds a new configuration option in the SharePoint admin centre that lets administrators set a maximum and a recommended expiration period for "People in your organization" links. A "People in your organization" link allows any authenticated member of your Microsoft 365 tenant to access the linked file or folder without the sharer needing to specify individual recipients. Before this change, those links had no expiry mechanism at the tenant or site level.
Microsoft describes the intent as reducing the risk of unintended long-term access to internal content. A link created during a project in 2023 and never revoked gives any current tenant member access to that file indefinitely. The new policy gives administrators a way to impose an upper limit on how long those links remain active.
Why This Matters for SharePoint Admins
Org-wide sharing links are common. They are convenient to send in Teams chats and emails because the recipient does not need to request access separately. Over time they accumulate across a tenant: a document shared during a project, a policy file circulated to all staff, a form sent to the whole company. Without expiry, every one of those links remains live long after its original purpose is served.
The governance risk is concrete. When an employee leaves and their account is removed from Entra ID, they lose authenticated access to the tenant. But a "People in your organization" link is not personal: it is valid for any current tenant member. If a link was circulated more broadly than intended, the original sharer may have long forgotten about it. The new expiry policy is a systematic fix rather than a case-by-case clean-up task.
For organisations preparing for Microsoft 365 Copilot, this change also matters for data governance. Copilot surfaces content that users have access to. Org-wide links that are years old and never revoked can broaden Copilot's effective content scope for individual users well beyond what the content owner intended.
How to Configure the Sharing Link Expiry Policy
Tenant-wide expiry settings
The configuration lives in the SharePoint admin centre under Policies > Sharing. Look for the section covering "People in your organization" links. You can set two values independently: a maximum expiry period (the hard ceiling, which users cannot exceed when creating a link) and a recommended period (the default suggested to users at the point of link creation, which they can adjust up to the maximum). Both values can be configured separately for SharePoint sites and OneDrive.
If you leave the maximum expiry field blank, existing behaviour continues: links have no expiry by default.
Site-level overrides
If your organisation has sites that handle more sensitive content, you can apply a stricter (shorter) expiry at the individual site collection level. Site-level settings override the tenant-wide maximum for those specific sites. A Human Resources site, for example, could be configured to expire org-wide links after 30 days while the rest of the tenant defaults to 180 days.
What Happens to Existing Sharing Links
Enabling an expiry policy does not retroactively delete existing "People in your organization" links. When an existing link is activated by a user after the policy takes effect, the system applies the configured expiration timeframe to that link going forward. New links created after the policy is configured automatically receive the expiry date at the point of creation.
This means the full effect of the policy builds gradually rather than invalidating every existing link at once. If critical documents are shared via org-wide links and accessed regularly, users who hold those links will be prompted to renew them when expiry is reached. Factor this into your internal communications if you adopt a short window.
Three Steps to Take Before the Rollout Completes in Your Tenant
- Confirm whether the feature has reached your tenant. Check the SharePoint admin centre under Policies > Sharing. If you see the "People in your organization" link expiry configuration option, the feature is live in your tenant. If not, expect it before the end of June 2026.
- Audit your current org-wide sharing links. Before setting a policy, understand the scale of active links in your environment. ShareMaster's Shared Links and Permissions tool lists active sharing links across your SharePoint sites, including link type and creation date, so you can see how many "People in your organization" links are currently in circulation and how old the oldest ones are.
- Decide on a maximum expiry period. For most organisations, 90 to 180 days is a reasonable starting maximum. Legal, HR, and finance sites may warrant a shorter limit. Set the recommended period at a value your users will find sensible: 60 to 90 days is a common default for internal links in regulated environments.
Frequently Asked Questions
What is a 'People in your organization' sharing link in SharePoint?
A "People in your organization" link grants access to any authenticated member of your Microsoft 365 tenant. It does not restrict access to a specific person. Anyone in the organisation with the link URL can use it to view the file or folder, provided they are signed in with a work account in your tenant. This is distinct from anonymous links (no sign-in required) and specific-person links (only named recipients can use them).
Will existing 'People in your organization' links expire when I set a policy?
Existing links are not retroactively deleted. When an existing link is used after the policy takes effect, the system applies the configured expiration timeframe to that link going forward. New links created after the policy is in place automatically receive an expiry date at the point of creation.
Where do I configure the sharing link expiry policy in Microsoft 365?
The setting is in the SharePoint admin centre under Policies > Sharing, in the section covering "People in your organization" links. You can set maximum and recommended periods separately. Site-level overrides for individual site collections are available through site settings in the admin centre or via PowerShell.
Sources: Microsoft 365 Message Center MC1242772; Office 365 for IT Pros: Company-Wide Sharing Links Get Expiration Limits; AdminDroid: Configure Expiration Policy for SharePoint Org Links.