SharePoint Online SharingCapability: Set-SPOTenant and Set-SPOSite external sharing values

SharingCapability decides how far content can be shared outside the organization. Set it for the whole tenant with Set-SPOTenant and narrow it for single sites with Set-SPOSite, after Connect-SPOService -Url https://contoso-admin.sharepoint.com:

Set-SPOTenant -SharingCapability ExternalUserSharingOnly
Set-SPOSite -Identity https://contoso.sharepoint.com/sites/finance -SharingCapability Disabled

Values

The enum has four names in module 16.0.27709.12000 (read offline), and Set-SPOTenant -SharingCapability, -OneDriveSharingCapability and Set-SPOSite -SharingCapability all use the same type:

Import-Module Microsoft.Online.SharePoint.PowerShell -DisableNameChecking
$t = [Microsoft.Online.SharePoint.TenantManagement.SharingCapabilities]
[enum]::GetNames($t) -join ', '
foreach ($c in 'Set-SPOTenant:SharingCapability','Set-SPOTenant:OneDriveSharingCapability','Set-SPOSite:SharingCapability') {
  $cmd, $par = $c -split ':'
  $pt = (Get-Command $cmd).Parameters[$par].ParameterType
  '{0} -{1}: {2}' -f $cmd, $par, $pt.GetGenericArguments()[0].Name
}

Disabled, ExternalUserSharingOnly, ExternalUserAndGuestSharing, ExistingExternalUserSharingOnly
Set-SPOTenant -SharingCapability: SharingCapabilities
Set-SPOTenant -OneDriveSharingCapability: SharingCapabilities
Set-SPOSite -SharingCapability: SharingCapabilities

Tenant and site

The tenant value is the upper limit. A site can be set to the same or a more restrictive value, never a more permissive one. Get-SPOSite -Identity URL | Select-Object SharingCapability,SiteDefinedSharingCapability shows the effective value (site and tenant combined) and the value stored on the site.

OneDriveSharingCapability is the same setting for OneDrive sites and cannot be more permissive than SharingCapability.

Check the current values

Get-SPOTenant | Select-Object SharingCapability,OneDriveSharingCapability
Get-SPOSite -Identity https://contoso.sharepoint.com/sites/finance | Select-Object Url,SharingCapability

Query sites one by one with -Identity: when -Limit or -Filter is used, Microsoft documents that SharingCapability and several other properties are not populated and may show a default value.