Sharing Links Without Expiration in Microsoft 365
A sharing link without expiration may remain useful—or may outlive the collaboration that justified it. Administrators need to distinguish policy, link type, business purpose, and actual permission state.
Expiration depends on link type and policy
Microsoft 365 administrators can require Anyone links to expire and define a maximum number of days. Site-level settings can follow or override the organization-level policy within permitted boundaries. Authenticated guest expiration is a separate control and should not be confused with link expiration.
Changing policy does not answer every historical question
Review how a new expiration value affects existing links in your tenant and site context. Microsoft documentation notes that shortening the permitted lifetime can update longer existing Anyone-link expirations, while increasing it does not necessarily extend existing links. Validate current documentation before a change.
Why no-expiration links deserve review
- The original project or recipient relationship may have ended.
- The link may have been forwarded.
- A folder may contain newer content than when sharing began.
- Ownership may have changed.
- The site’s business purpose may have changed.
No expiration is a risk factor, not an automatic incident. Combine it with link scope, role, item type, recipient evidence, age, site context, and business need.
Use a controlled review process
Identify links without expiration, confirm the owner and purpose, set or replace access where Microsoft supports it, and verify the final permission state. If a direct update is unavailable, revocation and recreation can change the URL and interrupt users; disclose that impact before action.
Do SharePoint and OneDrive sharing links expire automatically?
It depends on link type and configured policy. Administrators can require Anyone links to expire at organization level and can configure supported site-level overrides. Guest-account expiration and reauthentication are separate controls; they should not be described as if they were the same as link expiration.
For each observed link, record its actual expiration value and policy context rather than inferring it from today’s default. Compare how to find Anyone links with the Anyone versus Specific people comparison.
Reviewed by the SharedLinks365 Technical Team — AGORA TECH S.r.l.