SharePoint Hero Links Can Distort Sharing and Permission Reports
Diesen Beitrag auf Deutsch lesen
Hero links may exist without unique permissions, so SharePoint inventories must check permission inheritance before treating every link as deliberate sharing.
TL;DR
A PnP PowerShell inventory can enumerate SharePoint file and folder sharing links, then compare each item with HasUniqueRoleAssignments. Hero links may exist without unique permissions and can appear as Anonymous, without an expiry date, with blank users and a View type, so exported links need interpretation before cleanup.
Original on Blog about anything related to my learnings. Read the original
This is our own summary, not a republication or full translation.
Governance takeaway
- Admins/CoE: Run the inventory and compare each link with HasUniqueRoleAssignments, because a hero link does not prove broken inheritance.
- Security/Compliance: Treat Anonymous scope, blank users and missing expiry as possible hero-link indicators, not conclusive evidence of deliberate exposure.
- Leadership/Business: Expect migration and cleanup work to be harder when Copy link returns opaque hero-link IDs instead of understandable paths.
Frequently asked questions
How does SharePoint Copy link behave when hero links are enabled?
Copy link returns the hero link instead of the underlying path, even when the default setting is OnlyPeopleAdded.
What does HasUniqueRoleAssignments add to a SharePoint sharing-link inventory?
It shows whether the linked file or folder has unique permissions, helping separate permission exceptions from hero-link noise.
Why can a SharePoint hero link appear as Anonymous with blank users?
Hero links may report Anonymous scope, no expiry date and blank users even when additional users were added.