The feature is still In development, and Microsoft estimates general availability in February 2027. Nothing described here is in tenants yet. The roadmap's own fine print says dates and descriptions can change, and that entries may be removed when a feature ships, is cancelled or is postponed.
What the roadmap actually promises
The entry is short. Here is what it supports:
- User-set expiration: People will be able to set expiration dates for "Anyone" and "People in your organization" access on the main link to files and folders in OneDrive and SharePoint.
- Admin enforcement: Administrators will be able to require expiration and set a maximum access duration.
- Separate dials: OneDrive and SharePoint get separate settings.
- Graceful expiry: When access expires, the main link itself remains, and permissions granted directly to individuals are preserved.
- Broad coverage: Android, desktop, iOS, Mac, mobile and web, across Worldwide (Standard Multi-Tenant), GCC, GCC High and DoD clouds, in the General Availability release ring.
Microsoft says the goal is to help organizations align content sharing with their data governance requirements.
In short: this is a planned expansion of time limits on link-based access, with policy enforcement and separate OneDrive and SharePoint controls. It is not a shipped feature.
Wait, didn't Microsoft already do this?
Partly. Admins following Message Center may remember that Microsoft already added link expiration policies earlier in 2026.
Under MC1242772, Microsoft rolled out expiration policies for "People in your organization" links. The aim was to let administrators automatically expire these sharing links after a defined period, supporting stronger data governance and minimizing exposure from stale links. According to a copy of that message posted by Tophhie Cloud, the rollout was scheduled to start mid-March 2026. As with the new roadmap item, admins can configure maximum and recommended expiration timeframes separately for SharePoint sites and OneDrive.
That earlier change is managed in PowerShell. The Message Center text lists cmdlets such as Set-SPOTenant -CoreOrganizationSharingLinkRecommendedExpirationInDays <days> (SharePoint sites) and Set-SPOTenant -OneDriveOrganizationSharingLinkMaxExpirationInDays <days> (OneDrive). It also allows site-level overrides through Set-SPOSite -Identity <URL> -OverrideTenantOrganizationSharingLinkExpirationPolicy $true. The default doesn't change: "People in your organization" links continue to have no expiration unless an admin configures a policy.
Anyone links have had admin expiry for much longer. Microsoft's sharing-settings documentation says admins can require all Anyone links to expire and set a maximum number of days. If that maximum is later changed, existing links keep their current expiry when the new limit is longer, and move to the new limit when it is shorter. The setting is under Policies > Sharing in the SharePoint admin center.
So what is actually new?
What happens when the timer runs out. Microsoft's current Learn documentation says an expired "People in your organization" link stops working. The file isn't deleted, and anyone with other permissions keeps access. The new roadmap item works differently: the link stays in place and only the Anyone or organization-wide access on it expires.
The roadmap doesn't define "main link" or explain how this fits with the existing per-link policies. My reading, which is analysis and not Microsoft's wording, is this: today the link itself dies. Under the new model, the file's main shareable URL would keep existing but stop granting broad access, while anyone given direct permissions could still use it. If that's right, recipients with real direct access wouldn't be left with a dead bookmark.
The roadmap item also brings user-set dates and admin policies together across both link types, on every client platform, including the government clouds.
In short: the Anyone-link and organization-link expiration policies already exist. The new part is expiring the broad access on a link that stays in place, while direct permissions keep working.
How the three link types compare
The scope only makes sense if you know which link types it covers. Microsoft documents three:
| Link type | Who it works for | Auth required? | Covered by roadmap 571399? |
|---|---|---|---|
| Anyone | Anyone holding the link | No | Yes |
| People in your organization | Authenticated members (not guests) | Yes | Yes |
| Specific people | Named recipients only | Yes | Not mentioned |
Microsoft describes Anyone links as transferable, revocable secret keys. They can be forwarded, and they can't be audited because recipients don't sign in. Organization links can also be forwarded, but they need sign-in as a directory member.
A common misunderstanding: creating an organization link does not give the whole company access. Each person needs the link and has to redeem it. Microsoft's documentation adds that sending a link through the SharePoint or OneDrive web UI, Outlook or a Teams chat redeems it automatically for up to 100 individual recipients.
Why care about time limits on internal links? Vlad Catrinescu of Vlad Talks Tech notes that this link type has been sitting in the middle with no expiration option, which is exactly where Copilot exposure tends to pile up. A link sent in 2023 for a one-off budget review shouldn't still work in 2027.
The fine print admins should keep straight
Expiration is not revocation of everything. Microsoft's documentation and the roadmap agree that expiring link access doesn't delete the file and doesn't remove permissions granted another way. A user who was added directly to the file or site keeps access. Plan your permission reviews with that in mind.
Behavior for existing links is murky. Even for the current organization-link policy, sources disagree:
- Microsoft Learn says existing links aren't changed when a policy is turned on. When one is opened later, it's checked against the limit using its original creation date, and treated as expired if it's too old.
- The MC1242772 summary says much the same: Existing links expire upon use after rollout.
- Vlad Talks Tech, however, says the setting only applies to People in your organization links that are created after the policy is enabled.
I'd go with Microsoft's own documentation and test in a pilot tenant. The roadmap says nothing about how existing links will be treated under the new main-link feature, so don't assume either answer.
Don't confuse link expiry with guest expiry. The SharePoint admin center has separate settings for guest access expiring after a set number of days, and for reauthentication by people who sign in with verification codes. Those controls cover different access paths and don't replace link expiration.
Unknown details. The roadmap gives no maximum duration, default value, notification behavior, renewal process, licensing requirement or admin center location for the new controls. One third-party guide, ShareMaster, says the current organization-link policy accepts 7 to 720 days. That figure isn't from Microsoft, and it may not carry over to the new feature.
What to do before February 2027
These are practical recommendations based on how the feature is described, not steps published by Microsoft:
- Audit current sharing settings. In the SharePoint admin center under Policies > Sharing, note your Anyone-link expiry and permission settings. Check whether your org has already set organization-link limits with the MC1242772 PowerShell parameters.
- Inventory link usage. Find out which teams depend on long-lived Anyone and organization links, such as intranet pages, partner portals and embedded document links.
- Pick per-service limits. OneDrive (personal sharing) and SharePoint (team content) will have separate settings, so decide whether they should have different limits.
- Separate link access from direct permissions. Make sure people who need lasting access have it through direct permissions or group membership, not a broad link.
- Brief users. Explain that expired access can be restored by sharing again. When access on a link lapses, the content wasn't deleted.
- Watch Message Center. Before writing policy, confirm the final configuration options and rollout timing for your cloud. Government tenants are on the roadmap, but Microsoft hasn't given a schedule for each cloud.
The bottom line
This is a modest governance improvement. The expiration policies Microsoft added earlier in 2026 covered link lifetimes. This one targets the broad access on a file's main link while keeping the link and its direct permissions intact. How much it helps will depend on details Microsoft hasn't published yet, especially defaults, limits and how existing links are handled.
Until the feature ships, administrators can still use the controls that exist today, and the cleanup work above will need doing either way.