How do I disable "Get a Link" & "Share"

Question

My department is exploring SharePoint as an alternative to fileshares. Typically we create documents, then email links to the document.

it seems there are many types of links, which is confusing and will hinder user adoption. So far,

With SharePoint, it looks like the user has these options:

1. Copy-paste URL
   • Obviously a direct link
   • http://MYSITE/MYDOC.xls?d=UUID
2. "Share"
   • Also a direct link, but SharePoint will it in an email to selected users
   • http://MYSITE/MYDOC.xls?d=UUID
3. "Get a Link"
   • "Restricted link"
   • http://MYSITE/MYDOC.xls?d=UUID
   • "View link"
   • SharePoint mangles document-level permissions, then creates a new link
   • https://MYSITE/guestaccess.aspx?guestaccesstoken=UNIQUEID
   • "Edit link"
   • SharePoint mangles document-level permissions, then creates a new link
   • https://MYSITE/guestaccess.aspx?guestaccesstoken=UNIQUEID

The direct link will be best for us, but I know curious users will find the "View link" and "Edit link" options. Anytime they're curious, it will screw up file-level permissions, and we'll end up with a mess of different links.

How do I prevent users from creating guest access links, which change the file permissions?

Answer 1

You'll miss out of the Share part of SharePoint, but sharing can be disabled.

On the site collection you want to restrict:

• Click on the gear and select "Site Settings"
• Click on "Site Permissions" under "User and Permissions"
• In the ribbon, click "Access Request Settings"
• Uncheck "Allow members to share the site and individual files and folders."
• Uncheck "Allow access requests."

On the tenant, you may also want to restrict external sharing depending on your policies:

• Go to the SharePoint Online tenant admin center
• Click "Sharing"
• Select "Don’t allow sharing outside your organization"

A few things to keep in mind:

1. The direct link will only work if the user already has access to that site collection (or has permissions on the item or list level). Everyone else will get an access denied page.
2. When collaborating on documents, using the direct link in email may cause more headaches if all of the collaborators are not correctly authorized beforehand. This may drive users to download the document locally (which they can do as long as they have read access) and email it as an attachment. This will increase the mailbox size from attachments and prevent documents from being tracked or secured by SharePoint.
3. The Share button will still be shown even when sharing is disabled. When users click on the button, they may be presented with an error message or only the other users on the site collection.

Answer 2

Our experience is that after setting the above suggested settings, users could still share and copy links to those without access and it broke permission inheritancce (even broke it when the recipients already had access).

We found that on top of disabling sharing you need to change all users from 'edit' permissions to 'contribute'.

The edit permissions allow the user to share and copy link with the access level set to 'everyone in this organisation'. This is despite having shareing on the site and subsite disabled.

If you change the permission to 'Contribute' they can create, edit and delete folders and files as normal, but they can't see the site and document libary settings and when they share or copy link it will be with the default 'Only people with existing access'.

These links will no longer create unique permissions and your permission inheritance will remain intact.

Note: They can send the email to a person who has no existing access but they get a warning onscreen before doing so and the recipient will get a 'you do not have permission' warning when trying to use the link. A unique permission will not be created.