Microsoft is developing expiration dates for the main sharing link on files and folders in OneDrive and SharePoint. Users will be able to set an end date on "Anyone" and "People in your organization" access, and administrators will be able to require expiration and cap how long access can last. Microsoft lists the item as in development with a February 2027 availability date as its current plan, and preparing now is useful even before the feature arrives.
What Microsoft has announced
The Microsoft 365 release item, created on November 4, 2026, describes the change this way:
- People can set expiration dates for "Anyone" and "People in your organization" access on the main link to files and folders in OneDrive and SharePoint.
- Administrators get new policies to require expiration and to enforce a maximum access duration, with separate settings for OneDrive and SharePoint.
- When access expires, the main link itself remains, and permissions granted directly to individuals are preserved.
The roadmap data lists the item as in development. It shows a public availability date of February 2027 and no preview date. Roadmap dates can move, so treat February 2027 as Microsoft's current plan and not a commitment. The item lists Android, desktop, iOS, Mac, mobile and web, and the cloud instances Worldwide (Standard Multi-Tenant), GCC, GCC High and DoD. It does not state licensing requirements in the data we reviewed, so confirm those in your tenant's Message center when Microsoft announces the rollout.
Why sharing link expiration matters
A link that was created for one vendor for one project tends to stay alive long after the project ends. Links forwarded in email, pasted into chat or saved in a contractor's notes can outlive the working relationship by years. For businesses that handle customer records, financial files or contract documents, an old open link is a quiet gap that no one is watching.
Expiration turns that from a cleanup chore into a default. Instead of someone remembering to remove access, access ends on its own date. Microsoft's description is specific that the link remains and individually granted permissions are kept. That detail matters for planning: expiration of the main link is not the same as removing every person's access, so it does not replace a periodic review of who has direct permissions.
It also changes the conversation with the people you share with. A vendor, an accountant or a customer who is used to a link that never stops working will, at some point, find one that has. Telling them in advance how renewal works keeps that from looking like an outage.
Who is affected
Any organization that shares files from OneDrive or SharePoint by link is in scope once the feature is available. The administrator policy is the part that changes behavior for everyone: if an administrator requires expiration, users will be asked to choose an end date and will be limited by the maximum duration the administrator sets. Because OneDrive and SharePoint have separate settings, a company can be stricter on one than the other.
Because GCC, GCC High and DoD are listed alongside the standard commercial cloud, defense contractors that handle controlled unclassified information (CUI) in those environments should read this item too. We would still wait for Microsoft's rollout notice for your specific cloud before relying on the date.
What to do first: a checklist
None of these steps depend on the new feature. Doing them first means that when expiration policies become available, you can turn them on with confidence about what will change.
- Find out which sharing types your tenant allows. Have your administrator check whether "Anyone" links are enabled for OneDrive and for SharePoint. If nobody can name a business reason for them, consider limiting them. Microsoft's admin documentation says that where Anyone links are allowed, an administrator can already require them to expire within a set number of days.
- List the sites and folders that are shared externally. Start with finance, HR, contracts and customer data. Write down who owns each one.
- Remove links that are no longer needed. Old vendor, project and former-employee shares are the usual candidates. Ask owners before deleting anything that a customer or partner may still rely on.
- Decide a standard maximum duration. Pick a number that suits how you work, for example a different limit for short vendor projects than for long-term partners. You will need this answer when the administrator setting appears, and having it ready avoids a rushed guess.
- Name who renews access. When a link expires, someone will have to reissue it for the legitimate recipient. Decide who handles those requests so work is not blocked.
- Tell your staff. A short note explaining that shared links will begin to expire, and how to request a new one, prevents confusion when the first one lapses.
- Recheck direct permissions. Because individual grants survive expiration, review named guests and members on sensitive sites separately.
What can wait
You do not need to change any policy before Microsoft announces the rollout for your cloud instance, and you should not build a process around an exact February 2027 date. Detailed policy settings can wait until you see the actual admin controls. The cleanup in steps 1 through 3 is the only part worth doing early.
Common mistakes to avoid
- Assuming expiration revokes everything. Microsoft states the main link stays and direct permissions are preserved, so people granted access by name keep it.
- Setting the duration too short. A limit that makes staff reshare every few days pushes them toward copying files into email attachments, which is harder to control than a link.
- Treating it as a replacement for access reviews. Expiration limits link-based exposure. It does not tell you whether the right people have the right permissions.
- Skipping the owner list. When a link lapses, the first question is who owns the file. If no one can answer, the request stalls, so record owners during the cleanup.
How we can help
Summit Networks can review your OneDrive and SharePoint sharing settings, set up the expiration policies when they arrive, and walk your staff through the change. Our managed IT team handles Microsoft 365 administration for Colorado businesses, and you can reach us through our contact page.