In short
Microsoft Hero Link is the new default sharing link in SharePoint and OneDrive: every file and folder gets one primary link that stays the same, whether you copy it, email it or use the browser address. By default it only works for people you add yourself, and you can widen it to your organisation or to anyone with the link if your tenant allows that. Microsoft is rolling it out until the end of November 2026. Hero Link makes collaboration simpler, but it does not add recipient verification, mandatory expiry or an audit trail per transfer. For confidential files that go to external parties, you still need secure file transfer.
Sharing a file in Microsoft 365 used to create a new link almost every time. One file could end up with dozens of links, each with its own audience and rights. Microsoft Hero Link puts an end to that by giving every file a single, fixed link.
For users that is a real improvement. For IT managers and security officers it raises new questions: who can use that link, does it expire, and what happens when confidential documents go outside the organisation? This article explains what Hero Link is, what changes for admins and when you need more than a sharing link.
What is Microsoft Hero Link?
Microsoft announced Hero Link in May 2025 as the next step in sharing files in Microsoft 365. The idea is simple: one file, one link.
- One primary link per file or folder. Copy link, sharing by email and the address in your browser all return the same link.
- Safe default. The link starts as “Only people added”: it gives no access until you add people to the file.
- Adjustable audience. You can widen the link to “People in your organization” or “Anyone with the link”, as far as your tenant’s sharing policy allows.
- Changes apply to the same link. If you change the audience, Microsoft updates the existing link instead of creating a new one.
That makes sharing more predictable. People no longer receive five different links to the same document, and the owner can see more easily who has access.
When is Hero Link rolling out?
According to SysKit and Topedia, Microsoft is rolling out Hero Link in phases until the end of November 2026, as announced in Message center post MC1454378. Some users in your tenant may see the new experience before others.
What changes for Microsoft 365 admins?
- Default audience per site. Admins set the default audience of Hero Links per site with the
DefaultMainLinkScopesetting (via Set-SPOSite). There is no single tenant-wide switch. - Tenant policy still applies. Hero Link respects your sharing settings. If “Anyone” links are disabled, users won’t see that option.
- Permission inheritance. Creating the first Hero Link on a file breaks permission inheritance for that file.
- Existing links stay. Old links are not converted. They appear under “Other sharing links”, and time-limited links remain legacy links.
- Not everywhere yet. Word, Excel and PowerPoint on Mac still use the older share dialog, according to SysKit.
Security points to check before the rollout
Hero Link is designed with a safe default, but a few points deserve attention, especially in regulated organisations:
- Expiry policies don’t apply. SysKit reports that existing expiration policies for sharing links do not apply to Hero Links. A link you widen to “Anyone” can therefore stay active indefinitely.
- Sharing reports can look busier. Hero Links may show up on files nobody deliberately shared, which makes sharing reports harder to read.
- Removing access is all or nothing. “Remove access” removes everyone except the owner. “Reset link” creates a new URL, and people with existing permissions need the new link.
- No recipient verification per transfer. A link widened to “Anyone” works for whoever has it. There is no extra check that the right person opens the file.
None of this makes Hero Link unsafe. It is a collaboration feature, built for people who work together on documents. The question is whether it is the right tool for every type of file sharing.
Hero Link for collaboration, secure file transfer for external exchange
Within your organisation, Hero Link is a welcome improvement. Colleagues share one link, permissions are clearer and fewer stray links are created.
It gets different when confidential documents go to clients, suppliers, lawyers or regulators. Then you want to know for sure who opens the file, you want access to end automatically and you want to be able to prove afterwards what happened. Under the GDPR, NIS2 and DORA, that evidence is increasingly expected. Read more about the line between the two in SharePoint vs Secure File Transfer and in our article on secure file sharing with external parties.
Microsoft Hero Link vs Msafe: the comparison
| Microsoft Hero Link | Msafe Secure File Transfer | |
|---|---|---|
| Main purpose | Collaborating on files in Microsoft 365 | Controlled transfer of confidential files to external parties |
| Link | One fixed link per file | Personal invitation per recipient |
| Recipient verification | Depends on link audience and tenant settings | PIN code, 2FA or one-time code by phone |
| Expiry | Existing link expiry policies don’t apply | Expiry date per transfer, centrally enforceable |
| Revoking access | Remove access or reset the link for everyone | Revoke access per transfer or recipient |
| Evidence afterwards | Standard Microsoft 365 sharing reports | Audit trail of every upload, verification and download |
| Encryption | Microsoft 365 standard encryption | AES-256 encryption |
| Data location | Depends on your Microsoft 365 tenant | Hosted in the Netherlands |
| File size | Within Microsoft 365 limits | Up to 1 TB as standard, larger on request |
Using both: Microsoft 365 for collaboration, Msafe for external transfer
You don’t have to choose between Microsoft 365 and secure file transfer. Use OneDrive and SharePoint to collaborate, and Msafe as soon as a confidential file goes to an external party. With the Msafe Connector for Outlook, you send that file through Msafe from your own mail window: verified, time-limited and recorded.
Msafe connects to Microsoft Entra ID with Single Sign-On and SCIM provisioning, so user management stays in one place. External recipients don’t need an account: with Easy Download they verify once by phone and download the file.
Checklist for admins
- Decide per site which default audience Hero Links get with
DefaultMainLinkScope. - Check whether “Anyone” links are allowed in your tenant, and on which sites.
- Remember that existing link expiry policies don’t cover Hero Links, and decide how you handle that.
- Inform users that “Reset link” and “Remove access” affect everyone with access.
- Define which files may be shared via a Hero Link and which must go through secure file transfer.
- Make sure the secure route is just as easy, for example from Outlook, so nobody looks for a workaround.
Frequently asked questions about Microsoft Hero Link
What is a Microsoft Hero Link?
A Hero Link is the single, primary sharing link that every file and folder in SharePoint and OneDrive gets. Copying the link, sharing by email and the browser address all return the same link. By default only people you add have access.
Can Hero Links be shared with external users?
Yes, if your tenant and site settings allow it. You can add external people directly or widen the link to “Anyone with the link”. If external sharing or “Anyone” links are disabled, those options are not available.
Do Hero Links expire?
Not automatically. According to SysKit, existing expiration policies for sharing links do not apply to Hero Links. Time-limited links are still possible, but they remain separate, legacy-style links.
Can admins control Hero Link?
Admins set the default audience per site with the DefaultMainLinkScope setting, and tenant-wide sharing policies still apply. Test the settings on a pilot site before the rollout reaches all users.
Is Hero Link enough for GDPR, NIS2 or DORA compliant file sharing?
For internal collaboration it can be part of your approach. For confidential files that go to external parties, you usually need more: verification of the recipient, mandatory expiry, revoking access per transfer and an audit trail as evidence. That is where secure file transfer such as Msafe comes in.
See how Msafe works alongside Microsoft 365
In a short demo we show how employees share confidential files securely from Outlook, with verification, expiry and a full audit trail.
