30-second answer

PowerShell
Connect-PnPOnline -Url https://contoso-admin.sharepoint.com -Interactive -ClientId $clientId
$tenant = Get-PnPTenant
$tenant.DefaultSharingLinkType   # None | Direct | Internal | AnonymousAccess

This is the value every site inherits when it sets no default of its own, which on a real tenant is most of them. It is a different question from whether Anyone links are permitted at all.

What this proves

What a person gets when they press Share on a site that has not decided for itself. Direct shares with the people named, Internal produces a link that works only inside the organisation, and AnonymousAccess produces the Anyone link, which needs no sign-in.

Read together with the site value, it also tells you which sites have overridden the organisation and which are simply following it.

What it does not prove

  • What any individual site does. A site may set its own default and override this completely. The site level is a separate read, and the two are meant to go together.
  • What links people actually create. The default is one click from being changed at share time, within what the organisation permits. This reads the setting, not the behaviour.
  • Anything about Outlook on the web, Outlook 2016, or Office clients older than 2016. Microsoft states the default applies to the modern experience and does not affect those paths.

PowerShell

PowerShell
$clientId = '00000000-0000-0000-0000-000000000000'
Connect-PnPOnline -Url https://contoso-admin.sharepoint.com -Interactive -ClientId $clientId

$tenant = Get-PnPTenant
[pscustomobject]@{
    Capability      = $tenant.SharingCapability
    DefaultLinkType = $tenant.DefaultSharingLinkType
}

Both values in one object, because the second one only means something in the light of the first: an organisation with SharingCapability set to Disabled cannot have the Anyone link as a default, so the question does not arise.

Example output

Text
Capability                  DefaultLinkType
----------                  ---------------
ExternalUserAndGuestSharing AnonymousAccess

SharingCapability returns one of Disabled, ExternalUserSharingOnly, ExternalUserAndGuestSharing or ExistingExternalUserSharingOnly. DefaultSharingLinkType returns one of None, Direct, Internal or AnonymousAccess.

Explanation

The organisation default is the setting nobody thinks about, which is exactly why it matters. It is what happens across every site that has never chosen for itself, exercised by everybody who shares something without stopping to look at the link type.

Microsoft names the risk and the fix in the same paragraph on its own best practice page: a user who forgets to change the link type while sharing a sensitive document "might accidentally create a sharing link that doesn't require authentication", and the mitigation is "changing the default link setting to a link that only works for people inside your organization".

That is guidance rather than a requirement. The product permits the alternative, the documentation explains how to choose it, and an organisation whose work is genuinely public may reasonably keep it. What is not reasonable is having it by accident.

Note that this is a connection to the SharePoint admin centre, not to a site. Get-PnPTenant returns the tenant object, and reaching it needs an administrative connection even though the question sounds site sized.

Production considerations

  • This is a read. Get-PnPTenant changes nothing. The cmdlet that writes is a different one, and nothing on this page calls it.
  • Observed on a tenant, not only against the module: the call returns these properties and the values fall in the enum above. Values seen on your own tenant are still the only thing that describes your own tenant.
  • Leaving the Anyone link available is not the same as making it the default. The recommended arrangement keeps it selectable for people who choose it deliberately. Removing it entirely is a different decision with different consequences.
  • Changing this moves every site that has not overridden it, which is the reach that makes it worth reading and also worth thinking about before changing.

SPO-SHARE-003 reads exactly this value and fails when the organisation default is the Anyone link. It is scoped to organisations that permit Anyone links at all: where the capability forbids them, the rule reports not applicable rather than a pass, because nothing was mitigated.

The rule's own limitations record what a pass does not settle: a safe organisation default says nothing about an individual site, and a site that overrides it with the Anyone link passes this rule while failing the site level one.

References

Found something wrong? Suggest a correction. The article source is not public; the engine it cites is.

What this answer underwrites

The engine reads these Microsoft operations to collect evidence, so what is established here is what those collectors rest on.

  • tenant-sharingwhat the organisation permits, which every site inherits by default