Microsoft closed a significant governance gap on July 20, 2026, when it officially launched expiration policies for “People in your organization” sharing links across SharePoint and OneDrive. Previously, only anonymous or external guest links could be set to expire automatically; now IT administrators can put a hard limit on how long internal links remain usable — and they should act fast to prevent broken workflows and simmering user frustration.

What the policy actually does

The new capability, tracked under Microsoft 365 Roadmap ID 553220, lets organizations define separate maximum and recommended expiration periods for both SharePoint and OneDrive. A "People in your organization" link — which works only for authenticated members of your tenant — can now be forced to stop working after a set number of days, rather than living indefinitely in old email threads, Teams chats, and intranet pages.

Key settings administrators can now configure:

  • Maximum expiration (7–720 days): An upper boundary no user can exceed. Set it to 90 days, and nobody can create an organization-wide link that lasts 180 days. You can also set it to 0 to disable the requirement entirely, but Microsoft warns you should test that behavior first.
  • Recommended expiration: A softer target that appears by default in the sharing dialog. Users can adjust the period up to the maximum if they have a reason, but the nudge helps shorter lifetimes become the norm.
  • Separate SharePoint and OneDrive controls: The two services have different collaboration patterns. Many organizations will set OneDrive links to expire faster (e.g., 30 days) because personal storage shouldn’t become a permanent document distribution system, while SharePoint team sites get a longer leash (e.g., 90 days).
  • Site-level overrides: PowerShell commands let you assign tighter or looser rules to specific sites. A sensitive HR repository might get a 7-day maximum, while a long-running project workspace gets 180 days — but only with documented business justification.

Configuration happens primarily through the SharePoint Online Management Shell. To set a tenant-wide SharePoint maximum of 90 days, for instance:

Set-SPOTenant -CoreOrganizationSharingLinkMaxExpirationInDays 90

OneDrive’s equivalent:

Set-SPOTenant -OneDriveOrganizationSharingLinkMaxExpirationInDays 30

And to create a site exception:

Set-SPOSite -Identity <site-address> `
  -OverrideTenantOrganizationSharingLinkExpirationPolicy $true `
  -OrganizationSharingLinkMaxExpirationInDays 15

The graphical admin center may eventually surface these controls, but for now, PowerShell is the authoritative tool. That means smaller shops without dedicated scripting expertise should deliberately plan who handles the configuration — and who audits it later.

Why it matters for your daily work

If you’re an employee who regularly shares “People in your organization” links, you’ll notice a new expiration date appear in the sharing dialog. That date won’t be optional if your admin has set a maximum; you might even find a previously trusted link refuses to open weeks after you sent it. The file is still there — expiration kills the link, not the document — but recipients will need you to reshare or switch to a different access method.

For site owners and intranet managers, this is where the real pain hides. Over the years, many teams have used organization-sharing links as permanent navigation elements: tucked into Quick Links web parts, Teams tabs, internal knowledge base articles, and Power Automate notifications. All of those could break silently once the policy kicks in. Take an inventory now. Any link that includes a sharing token (often visible in its URL structure) should be replaced with a direct file path or an “existing access” link — which works only for people already granted permission through a SharePoint group, not as a new access grant.

IT support desks will field complaints that “SharePoint deleted my file” or “the Teams link is dead.” A diagnostic checklist helps:

  • Did the sharing link expire? (Check creation date and policy.)
  • Was the file moved or deleted? (Verify in the document library.)
  • Did the recipient lose site membership or have their account disabled?
  • Is a sensitivity label or conditional-access policy blocking access?

Arm your helpdesk with those questions; it will reduce unnecessary permission escalations.

Developers and automation owners are not safe either. Any Power Automate flow, custom app, or bot that generates and stores an organization link assumes that URL will work forever. Introduce an expiration, and you introduce a delayed failure that could take months to surface. Inspect your code: if the goal is simply to give someone a durable path to a file, use a direct library URL and manage site permissions. If you need timed access, then sharing links fit — but expect to handle renewal logic.

The road to expiration: why it took so long

Admins have long been able to apply expiration to “Anyone” and external guest links. Internal sharing, however, was treated as inherently safe — a holdover from when organizations were smaller and internal leak risks were underappreciated. But “People in your organization” links are transferable: any employee who possesses one can forward it to another employee, and if that person authenticates, they get access. Over years, links accumulate across email, chat, ticket systems, and wikis, creating invisible access sprawl.

The push for this capability grew louder through 2025. Microsoft guidance as late as that year confirmed that mandatory expiration still skipped internal links. Then on February 6, 2026, Roadmap ID 553220 appeared. General availability began rolling out in mid-March, with completion targeted for late May for worldwide tenants and late June for government clouds (GCC, GCC High, DoD). The July 20 switch to “Launched” simply made it official: the feature is now generally available, not merely rolling out.

How to configure expiration policies (and avoid chaos)

Don’t flip the switch on a Tuesday afternoon without preparation. A controlled rollout looks like this:

1. Inventory current sharing behavior. Use SharePoint and OneDrive usage reports, audit logs, and site owner interviews to understand where organization links are truly business-critical. Identify sites where those links appear in intranet navigation or automations.

2. Decide on baselines. Many organizations start with:
- SharePoint: recommended 30 days, maximum 90 days
- OneDrive: recommended 14 days, maximum 30 days
- High-security sites: override maximum to 7–30 days
- Long-term project sites: override maximum to 180 days, paired with a formal exception process

OneDrive’s shorter limit nudges teams toward moving durable content into SharePoint, where ownership is less tied to a single person.

3. Build an exception model. Every site override should have an owner, a justification, an approval date, and a review schedule. Without this, you’ll just trade permanent links for permanent exceptions.

4. Pilot with representative departments. Include communication sites, Teams-connected sites, and heavy OneDrive sharers. Test both creating new links and accessing older ones after policy activation — because legacy link behaviour can surprise you (more on that next).

5. Communicate clearly. Users need to know:
- Expiration applies to the link, not the file.
- They can still reshare or create a new link.
- A “specific people” link is more appropriate when only named colleagues should see the document.
- Permanent references should use site-managed permissions and “existing access” links, not sharing grants.

6. Validate after deployment. Use PowerShell to confirm settings, and simulate expired-link scenarios with a test user before anyone else reports them.

Microsoft’s guidance on pre-existing links reads in two parts: only new links created after the policy automatically get the expiration; however, older links may also get an expiration when they are used after the feature is available. In other words, a link from six months ago might look fine until someone clicks it, at which point an expiration clock could start. The exact behaviour may vary by tenant and timing, so do not document internally that “old links are unaffected.” Test it. Create a link in a test site before flipping the policy, then access it later and observe.

This nuance also means that simply setting a policy today doesn’t immediately clean up years of stale access. That old link in a 2024 email remains a valid token until someone uses it — and that might happen years from now. Over time, as people open those links, they’ll get expired, but the cleanup is gradual, not instant.

The bigger picture: governance, Copilot, and what’s next

Link expiration is not a silver bullet. It doesn’t replace Microsoft Purview retention (which controls how long content must be preserved), sensitivity labels (which classify and protect), or formal access reviews. A document can be subject to a seven-year legal hold while its sharing link dies after 30 days — and that’s a good thing. Expiration limits exposure without interfering with compliance obligations.

But the feature does fit squarely into the zero-trust principle of “assume breach.” Even inside the organization’s authentication boundary, threat actors with compromised accounts can exploit open-ended sharing links. And accidental over-sharing remains common: an internal link to salary data or merger plans can easily land in front of someone who shouldn’t see it. Time-bound links reduce that window.

The Copilot angle adds pressure. Microsoft 365 Copilot surfaces content based on user permissions, including access gained through shared links. While creating a “People in your organization” link doesn’t expose the file to everyone in tenant search, once it’s redeemed by an individual, Copilot can include that content in responses for that user. Expiry helps ensure that someone who no longer needs access doesn’t continue to benefit from a link they received a year ago — and that your sensitive data doesn’t appear in unintended AI summaries.

What to watch next

  • Reporting and visibility: Microsoft has not yet delivered admin reports showing links nearing expiration or sites with heavy organization-link usage. That will be essential to measure policy effectiveness.
  • Renewal workflows: Ideally, users would receive a notification before a link expires and be able to refresh it with justification — rather than discovering the break only when a document won’t open.
  • Sensitivity label integration: Automatically applying shorter expiration to confidential sites would deepen the policy’s impact.
  • Government cloud availability: While GCC, GCC High, and DoD tenants should have the feature, verify your own tenant before relying on roadmap status.

Ultimately, Roadmap ID 553220 is not a set-it-and-forget-it switch. It’s a tool to start differentiating between temporary, one-off sharing and durable publishing. Deploy it thoughtfully, with training and monitoring, and you’ll close a long-standing loophole without cratering collaboration. Rush it, and you’ll drown your helpdesk in “my links are broken” tickets — while users quietly find unmanaged workarounds.