Default sharing link type is the tenant setting that determines what kind of access link is created when a file is shared or uploaded. If configured broadly, it can silently expand the internal audience for new files, making access behavior depend on policy inheritance rather than the user’s intent.
Expanded Definition
Default sharing link type is a policy setting that determines what access scope is generated when a user shares a file or when a workflow uploads content into a shared repository. In practice, it can convert a private object into a broadly accessible one without a separate approval step.
In NHI and collaboration security discussions, this setting matters because it influences inherited access, not just the action a user intended. Definitions vary across vendors, and no single standard governs this yet, so security teams should treat it as a control-plane decision rather than a convenience feature. The closest governance lens is NIST Cybersecurity Framework 2.0, which emphasizes access control, data protection, and continuous governance over identity-driven resources.
The most common misapplication is assuming the default is harmless, which occurs when administrators leave broad link creation enabled in tenants that also accept automated uploads, sync clients, or agent-generated content.
Examples and Use Cases
Implementing default sharing link type rigorously often introduces friction for collaboration, requiring organisations to weigh convenience against the risk of unintended exposure.
- A marketing team uploads campaign assets into a shared workspace, and the default link type creates tenant-wide access instead of a restricted internal link.
- An AI Agent publishes generated reports to a document library, and the upload inherits a shareable link scope that exceeds the team’s intended audience.
- A service account syncs files into a repository during an automation run, but the default link setting turns each new object into an accessible resource for broader staff groups.
- A contractor receives a link to a file, and the tenant’s default behavior allows onward sharing, complicating containment when the file later needs to be revoked.
For identity governance, this is comparable to poorly managed NHI access paths described in the Ultimate Guide to NHIs, where policy inheritance can create exposure that users do not notice. Organisations often pair the setting review with RBAC design and data classification rules, while aligning the workflow to NIST Cybersecurity Framework 2.0 outcomes for controlled access and protected data handling.
Why It Matters in NHI Security
Default sharing link type becomes a security issue when automation, service accounts, or agentic workflows create content at scale. If the default is too broad, the problem is not just user error. It becomes a repeatable exposure pattern that can spread sensitive files across internal domains, partner spaces, or even externally shared channels.
This is especially important for organisations that already struggle with visibility into identity-driven assets. NHIMG research shows that only 5.7% of organisations have full visibility into their service accounts, and that lack of oversight can make inherited sharing behavior harder to detect until a review, incident, or audit exposes it. The broader NHI posture discussed in Ultimate Guide to NHIs shows why access defaults must be governed alongside secrets, rotation, and offboarding. The same operational mindset fits NIST Cybersecurity Framework 2.0, where protecting data means controlling how access is created and sustained.
Organisations typically encounter the consequence only after a file leak, partner complaint, or access review failure, at which point default sharing link type becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Broad defaults can expose secrets and shared resources through weak NHI access handling. |
| NIST CSF 2.0 | PR.AC-3 | Access management governs how default link scopes expand or restrict data access. |
| NIST Zero Trust (SP 800-207) | AC-4 | Zero Trust requires policy-enforced resource access, not permissive sharing defaults. |
Review sharing defaults and restrict inherited access paths that expand NHI-driven exposure.
