Microsoft Just Changed SharePoint and OneDrive File Sharing: Hero Links Explained

Microsoft is rolling out a major update to how files and folders are shared in SharePoint and OneDrive. The new experience introduces something called Hero Links, designed to simplify sharing and make managing access much easier.

Previously, sharing the same document with different people or permissions could result in multiple sharing links. If you needed to change access, you often had to generate another link.

Hero Links change that by introducing one primary sharing link per file or folder, with permissions that can be updated even after the link has been sent.

Let's walk through what's new and some important considerations for administrators.

1. A New Sharing Experience#

The biggest change is the redesigned sharing dialog, which combines sharing and access management into one interface.

By default, Hero Links are set to Only people added, meaning the link itself doesn't grant additional access. Users can change the audience to:

• Only people added: Users who already have permission to access the document.
• People in your organization: Internal users who have the link.
• Anyone with the link: Anyone who has the URL, assuming your organization's sharing policies allow it.

You can also add users directly, grant view or edit access, and update those permissions without generating a new sharing link.

For example, if I share a document with someone and initially give them view access, I can update their permissions to edit from the same interface. Their existing link continues working with the updated permissions.

Similarly, changing the Hero Link's audience updates the existing URL instead of creating another one.

2. Additional Sharing Links Still Exist#

Microsoft hasn't eliminated traditional sharing links.

You can still select Create new sharing link to generate a separate URL with its own access settings.

This is particularly useful when you need:

• A specific audience for a document.
• A separate link with an expiration date.
• Password protection for supported link types.
• Different view or edit permissions.

For example, I might create a link for an external contractor that automatically expires after seven days.

These additional links are managed under the Other sharing links section of the new sharing interface.

3. New Sharing Settings#

Microsoft also introduced additional controls under the Settings menu.

People with edit access can reshare

Controls whether users with editing permissions can share the document with additional people. Existing tenant and site sharing restrictions still apply.

Apply folder access changes to this item

Controls whether folder-sharing changes are pushed down to an individual file.

For example, if I'm collaborating with an external agency on a website redesign, I might want them to access project documents without automatically receiving access to an internal budget.

This setting can help control that sharing behavior, although underlying SharePoint permissions still need to be configured appropriately.

Reset link

Invalidates the existing Hero Link and generates a new URL configured for Only people added.

This is useful if a sharing URL was accidentally exposed or forwarded to unintended recipients. Users with independently assigned permissions retain those permissions.

Remove access

A broader action that removes people explicitly added to the file and restricts the Hero Link. In my testing, this option was available in OneDrive, while the SharePoint experience exposed Advanced permissions instead.

4. What Administrators Need to Know#

While Hero Links simplify the end-user experience, there are a few administrative considerations.

Existing sharing restrictions still apply#

Your existing SharePoint and OneDrive sharing restrictions continue to govern what's allowed.

For example, if a SharePoint site doesn't permit external sharing, users cannot bypass that restriction by changing their Hero Link to Anyone.

These policies can be managed in the SharePoint Admin Center → Policies → Sharing, with additional restrictions configured at the site level.

Hero Link defaults are managed separately#

Microsoft introduced a PowerShell parameter called DefaultMainLinkScope that allows administrators to configure the default Hero Link audience for a SharePoint site collection or OneDrive.

For example:

Set-SPOSite -Identity https://contoso.sharepoint.com/sites/Finance `
    -DefaultMainLinkScope OnlyPeopleAdded

The default effective setting is OnlyPeopleAdded. You can also configure Organization for sites intended for broader internal collaboration.

This controls the default audience, not the maximum access users are permitted to grant.

Review expiration policies#

Existing sharing-link expiration policies do not currently govern Hero Links.

This is especially important if your organization relies on automatic expiration of Anyone links as a security control.

Until Microsoft releases dedicated expiration controls, administrators should be intentional about when users create broadly accessible Hero Links versus separate time-limited links.

SharePoint permissions and Copilot still matter#

Hero Links don't change SharePoint's underlying permissions model. Direct sharing can still create unique permissions, and resetting a link doesn't necessarily remove every other way someone can access a document.

This also matters for Microsoft 365 Copilot.

Creating an organization-wide Hero Link doesn't automatically make a document discoverable to every employee through Copilot. However, once a user receives and redeems that link, the document can become discoverable to them through Microsoft Search and Copilot.

As organizations continue adopting AI, understanding who has access to SharePoint content remains critically important.

Auditing Sharing Links Across the Tenant#

The new interface makes it easier to manage sharing on a single file. It doesn't tell you what's already been shared across the entire tenant.

That's the gap we built CloudCapsule's new AI Readiness Assessment to cover. It does a deep dive on the links being shared in your organization, so you can see where content is overshared before you roll out Copilot.

The File Sharing section breaks shared files down by audience: Anyone with the link, organization-wide, and internal only. From there you can see each file's site and path.

If you're an MSP preparing a customer for Copilot, this is a good first step: run the assessment, review the sharing links it finds, and clean up the ones that shouldn't exist.

Try CloudCapsule for free (opens in new tab).

Final Thoughts#

Overall, I think Hero Links are a welcome improvement to the SharePoint and OneDrive sharing experience.

Having one primary link and being able to modify permissions without generating new URLs should make sharing significantly easier for end users.

For administrators, my recommendations are straightforward:

• Keep Only people added as the default for sensitive SharePoint sites.
• Review external sharing policies at both the tenant and site levels.
• Use additional links with expiration dates for temporary collaboration.
• Continue auditing sharing links and effective permissions, especially as you roll out Copilot.

The new interface makes collaboration easier, but it doesn't eliminate the need for good SharePoint governance.

Want to see the new experience in action?

Watch my full walkthrough at the top of this post, where I demonstrate the new sharing interface, additional settings, and administrative considerations.