Forum Discussion
Using Microsoft Purview to limit OneDrive external sharing capability
I want to enable OneDrive external sharing, but only for a specified group. The members of this group may change from time to time. There isn't any way for me to do this in the SharePoint Admin centre - I can't limit this functionality down to a group, without also limiting it for SharePoint (not something I want to do). Therefore, I'm looking at suitable solutions using labels and Microsoft Purview.
High-level requirement: is it possible to have a label which is only available to certain users (based on a security group membership) in their OneDrive. When they apply this label, external sharing is made available to them?
Further details:
- The label should only be made available to users in a specific security group
- The label should only be made available to their OneDrive
- May be applied to non-M365 files in their OneDrive (e.g. PDFs)
- Once the label is applied, they then have the option to share the file externally
- The user is enforced to enter a link expiry date (maximum 14 days)
- Once a user has been removed from the security group, they can no longer use the label
Questions:
- Is this possible? Or even partly possible?
- If possible, what would be the recommended/best-practice approach?
- If the above approach is feasible, can this be applied to folders, so we share multiple files in one go?
I know I would need to enable OneDrive external sharing for all, but I'm trying to work out an approach to limit it to just a smaller audience.
Thank you!
- You can configure sharing settings on a per-site basis via PowerShell, so generate a list of ODFBs for the users in said group and use Set-SPOSite to configure the restrictions. Labels can be overridden by users, as they "own" everything within their ODFB. 
2 Replies
- You can configure sharing settings on a per-site basis via PowerShell, so generate a list of ODFBs for the users in said group and use Set-SPOSite to configure the restrictions. Labels can be overridden by users, as they "own" everything within their ODFB. - harrydemediciCopper ContributorThanks VasilMichev for responding. We did look at this option but we are certain restrictions on how we can use PowerShell in our tenant. But it's something I'll take a further look into as it sounds like it would be the only option.