SharePoint external password enforcement

Hi @cyber punk

Thank you for raising this question. Currently, there is no native Microsoft 365 policy that forces users to add a password to every Anyone link created in SharePoint Online or OneDrive. Users may set a password when creating the link, but administrators cannot make that field mandatory at the tenant or site level. The closest enforceable alternative is to change external sharing from Anyone to New and existing guests, then encourage or require users to select Specific people when sharing. This provides identity verification and prevents a forwarded link from automatically granting access to another person.

If anonymous sharing is required for a small number of business scenarios, restrict it to approved users:

1. Open the SharePoint admin center.
2. Go to Policies > Sharing.
3. Expand More external sharing settings.
4. Enable Allow only users in specific security groups to share externally.
5. Add the approved security group.
6. Set that group to Anyone.
7. Set other groups to Authenticated guests only, or do not grant them external-sharing privileges.

Microsoft supports up to 12 security groups in this control. Users assigned Authenticated guests only cannot create unauthenticated Anyone links. This does not force passwords, but it reduces the population that can create passwordless anonymous links.

Ref: Allow only members of specific security groups to share SharePoint and OneDrive files and folders externally

-Require Anyone links to expire

You can enforce a maximum lifetime for Anyone links at the organization level:

SharePoint admin center > Policies > Sharing > Choose expiration and permissions options for Anyone links

Enable: These links must expire within this many days

Microsoft also exposes tenant and site-level PowerShell settings for anonymous-link expiration.

For example:

Connect-SPOService -Url https://contoso-admin.sharepoint.com
Set-SPOTenant -RequireAnonymousLinksExpireInDays 30

This limits exposure but does not require a password.

Ref: Best practices for sharing files and folders with unauthenticated users

-Change the default link type

Set the default sharing link to Specific people rather than Anyone. This helps prevent accidental anonymous sharing, although users may still override the default if the site permits Anyone links.

Sensitivity labels can also configure a more restrictive default sharing-link type for sites, OneDrive accounts, and documents. However, Microsoft notes that default settings can generally be overridden by users, so this is a guardrail rather than mandatory password enforcement.

Ref: Use sensitivity labels to configure the default sharing link type for sites and documents in SharePoint and OneDrive

I hope this information helps.