Security Policy Errors

How to Prevent SharePoint Sites from Inheriting Organization-Wide Sharing Settings

Maira Mehtab Sep 22, 2026 869 views

Question details

The user needs to maintain disabled external sharing on specific SharePoint sites after changing the tenant-wide SharePoint sharing policy.

Product: Microsoft SharePoint
Device & OS: not provided
Scenario: Updating organization-wide SharePoint sharing settings without overriding the restricted sharing capabilities of specific existing sites.
Observed behavior: Changing the tenant-wide policy inadvertently causes existing sites to allow external sharing, overriding their previously disabled state.

Before you start

Ensure you have PowerShell 7 installed along with the PnP PowerShell module, and verify that you have SharePoint Administrator privileges to modify tenant-level site settings.

Solution 1Recommended

Use PnP PowerShell to Disable External Sharing on Specific Sites

Run a PowerShell script using the PnP PowerShell module to manually enforce the 'Disabled' sharing capability on required sites.

When global tenant sharing settings are adjusted to be more permissive, existing sites may automatically inherit these new capabilities. To override this, administrators must explicitly set the sharing capability of sensitive sites to Disabled.

Using PnP PowerShell allows you to perform these administrative tasks efficiently, especially when targeting specific URLs while excluding system and special-purpose sites.

Launch PowerShell

Open PowerShell 7 on your system with administrator privileges.

Connect to SharePoint Admin Center

Authenticate to your tenant by running the command: Connect-PnPOnline -Url https://[yourtenant]-admin.sharepoint.com -Interactive

Identify Target Sites

Review your site inventory and compile a list of specific site URLs that need their external sharing capabilities explicitly disabled.

Execute the Disable Command

Run the following command for each required site: Set-PnPTenantSite -Url <site URL> -SharingCapability Disabled

Exclude System Sites

When applying this command, ensure you explicitly bypass system sites and special-purpose sites to avoid breaking native SharePoint functionalities.

Bulk Processing Advice: If you have a large number of sites, consider importing the target URLs from a CSV file and using a foreach loop in PowerShell to automate the process while skipping system sites.

Free Microsoft Office alternative

Looking for a Simpler Way to Manage and Share Documents?

While SharePoint handles complex enterprise-wide infrastructure and policies, WPS Office provides a lightweight, highly compatible alternative for everyday document creation and sharing. Enjoy a familiar interface and seamless file compatibility without the hassle of configuring tenant-wide sharing permissions.

1. Download the Installer: Visit the official WPS Office website to download the free version for your operating system.
2. Install WPS Office: Run the setup file and follow the quick on-screen instructions to install the suite.
3. Share Documents Securely: Use the built-in WPS Cloud features to easily control who can view or edit your documents without needing PowerShell scripts.

Fully compatible with Microsoft Office formats including .docx, .xlsx, and .pptx.Built-in cloud collaboration for secure and straightforward document sharing.Lightweight software footprint with a familiar, easy-to-use interface.Completely free to use for essential office and administrative tasks.

Frequently Asked Questions

Why do my SharePoint sites automatically inherit the new organization-wide sharing settings?

By default, SharePoint sites inherit the tenant-level external sharing policies to maintain administrative consistency. If the global policy is updated to be more permissive, existing sites adopt the new sharing level unless they have been explicitly restricted.

Can I disable external sharing via the SharePoint admin center interface?

Yes. You can manually navigate to the SharePoint admin center, go to 'Active sites', select the specific site, click on the 'Sharing' tab, and change the external sharing setting to 'Only people in your organization'.

What happens to existing external guest links when I change the capability to Disabled?

If you change a site's sharing capability to 'Disabled', all existing external guest links for that site will immediately expire, and external users will lose access to the shared files.

Which PnP PowerShell module is recommended for these tasks?

It is highly recommended to use the modern 'PnP.PowerShell' module running on PowerShell 7 or later. The older 'SharePointPnPPowerShellOnline' module has been deprecated and may not support newer tenant commands.

Microsoft Office Security Issues