Forum Discussion
harrydemedici
Apr 15, 2025Copper Contributor
Using Microsoft Purview to limit OneDrive external sharing capability
I want to enable OneDrive external sharing, but only for a specified group. The members of this group may change from time to time. There isn't any way for me to do this in the SharePoint Admin centre - I can't limit this functionality down to a group, without also limiting it for SharePoint (not something I want to do). Therefore, I'm looking at suitable solutions using labels and Microsoft Purview.
High-level requirement: is it possible to have a label which is only available to certain users (based on a security group membership) in their OneDrive. When they apply this label, external sharing is made available to them?
Further details:
- The label should only be made available to users in a specific security group
- The label should only be made available to their OneDrive
- May be applied to non-M365 files in their OneDrive (e.g. PDFs)
- Once the label is applied, they then have the option to share the file externally
- The user is enforced to enter a link expiry date (maximum 14 days)
- Once a user has been removed from the security group, they can no longer use the label
Questions:
- Is this possible? Or even partly possible?
- If possible, what would be the recommended/best-practice approach?
- If the above approach is feasible, can this be applied to folders, so we share multiple files in one go?
I know I would need to enable OneDrive external sharing for all, but I'm trying to work out an approach to limit it to just a smaller audience.
Thank you!
You can configure sharing settings on a per-site basis via PowerShell, so generate a list of ODFBs for the users in said group and use Set-SPOSite to configure the restrictions. Labels can be overridden by users, as they "own" everything within their ODFB.
You can configure sharing settings on a per-site basis via PowerShell, so generate a list of ODFBs for the users in said group and use Set-SPOSite to configure the restrictions. Labels can be overridden by users, as they "own" everything within their ODFB.
- harrydemediciCopper Contributor
Thanks VasilMichev for responding. We did look at this option but we are certain restrictions on how we can use PowerShell in our tenant. But it's something I'll take a further look into as it sounds like it would be the only option.