Copilot in OneDrive: Your Hero Links Plan by November 30

TL;DR: Copilot in OneDrive is now generally available, and Microsoft is rolling out hero links, one sharing link per file, to every Microsoft 365 tenant by the end of November 2026. Hero links start private by default, but your existing link expiration and default link policies do not apply to them. Set site defaults now and pilot Copilot on real work.

Microsoft just shipped the largest OneDrive update in years. Copilot in OneDrive can now analyze a stack of spreadsheets, reorganize a messy project folder and turn your files into an interactive HTML report. At the same time, the way every file in Microsoft 365 gets shared is changing. Under Message Center post MC1454378, hero links reach worldwide, GCC, GCC High and DoD tenants between early October and the end of November 2026, about six weeks from today.

The payoff is real: simpler sharing for users and faster, file-grounded work for anyone with a Microsoft 365 Copilot license. The risk is quieter. Microsoft states that existing default sharing link settings and link expiration policies apply to legacy links only, not to hero links. If your governance depends on those policies, you have a gap until Microsoft ships the expiring hero link controls it has announced as coming soon. This guide explains what changed, what it means for CIOs, CHROs and IT leaders, and a seven-step plan to land both changes with control.

What is changing in OneDrive this fall?

Three things change at once: Copilot in OneDrive reached general availability, sharing moves to one hero link per file, and admins get new governance and sync controls. Here is the short version, based on Microsoft's official OneDrive upgrade announcement and the related Message Center post.

Microsoft also announced new photo experiences, including the new Microsoft Photos app on Windows, AI-curated Moments, a map view and AI photo editing. They are mostly consumer features, so this guide focuses on the work changes above.

What are OneDrive hero links?

A hero link is the single, primary sharing link that every file and folder in OneDrive and SharePoint now gets, replacing the habit of creating a new link for every person and permission. You change who the link works for, and the same URL follows the new setting.

When a user opens the new sharing dialog, they see the people who have direct access and a File link settings row. By default it reads "Only people added to the file have access," which means the link grants access to no one beyond the people explicitly added. Users can widen it to people in your organization or, where your policy allows, to anyone with the link. They can also choose view, edit or view without download. Copying the link, sharing by email and pasting the browser address bar URL all use the same link.

Existing links keep working and move to an "Other links" section of the sharing dialog. Effective access is the most permissive combination of direct, inherited, group and link permissions, so a file can still be broader than its hero link suggests.

Why do your link expiration policies not apply to hero links?

Microsoft states in MC1454378 that existing default sharing link settings and link expiration policies apply to legacy links only. The only admin control today is the DefaultMainLinkScope setting in SharePoint PowerShell, which sets the default hero link audience per site or OneDrive to OnlyPeopleAdded (the default) or Organization. There is no tenant-wide setting yet, and the setting only controls the default, so users can still broaden access where policy allows.

Microsoft has announced expiring hero link controls as coming soon. In its example, a policy could make hero links shared with the whole organization expire after 90 days, at which point the link returns to "Only people added." Until that ships, a user who widens a hero link to the organization creates a link that stays open until someone narrows it.

One link per file is simpler for users. It is only safer if you decide what that link is allowed to become.

Why does the OneDrive upgrade matter for IT leaders?

It matters because sharing behavior and Copilot quality are now the same conversation. Copilot answers from what each person can access, so a link widened to the whole organization quietly widens what Copilot can surface for everyone who redeems it.

For CIOs, the question is control: which sites should default to "Only people added" and which can safely default to the organization. For CHROs, it is trust: people will change how they share files on the first day the new dialog appears, and HR, compensation and employee relations files are the content most likely to be overshared by accident. For IT leaders, it is support load: one link per file should reduce the "which link do I send?" tickets, but only if users understand the new File link settings row.

Nonprofit: donor, beneficiary and grant files often live in OneDrive folders shared with volunteers and partners. Review where external sharing is allowed before staff start widening hero links, and keep the default at "Only people added" for any site holding donor records.

Education: faculty share course material broadly and student records narrowly, often from the same OneDrive. Set DefaultMainLinkScope to Organization only on course and department sites, and keep it at OnlyPeopleAdded for advising, admissions and HR sites.

Government: the rollout includes GCC, GCC High and DoD. Records retention and freedom of information rules still apply to every file, so align hero link defaults with your records classification and confirm how your audit process reports link changes.

What should IT leaders do before hero links finish rolling out?

Work through seven steps in the next six weeks: inventory where sharing matters, set site defaults, prepare users, then pilot Copilot in OneDrive with measures in place. Most organizations can finish steps 1 to 4 before the end of November.

1. Map your sensitive sites. List the sites and OneDrive accounts holding HR, finance, legal, health or donor data. These are the places where the default must stay at "Only people added." If you already use sensitivity labels or Restricted Content Discovery for overshared SharePoint sites, start from that list.
2. Decide each site's hero link default. Use the decision table below. Set DefaultMainLinkScope to Organization only where broad internal sharing is the purpose of the site, and leave everything else at the default.
3. Review your legacy link policies. Your Anyone link expiration and default link settings still govern existing links. Keep them, document that they do not cover hero links yet, and note the gap in your risk register until expiring hero link controls arrive.
4. Brief users before the dialog changes. Explain one idea: change the File link settings row, do not create a new link. Show the "Other links" section so people are not surprised when their old links appear there. The original hero links explainer is a useful primer for champions.
5. Run an oversharing check. Use the SharePoint Admin Agent or SharePoint Advanced Management reports to find sites with broad access before Copilot in OneDrive scales. Our guide to mitigating oversharing for Microsoft 365 Copilot covers the full checklist.
6. Pilot Copilot in OneDrive on one recurring task. Pick a monthly report, folder cleanup or analysis that a team repeats. Have them save the process as a custom skill so the second run takes a prompt, not a morning. See how skills turn repeatable work into reusable AI workflows.
7. Set a Copilot Credits policy. Everyday Copilot in OneDrive capabilities are included with the Microsoft 365 Copilot license, while large-scale and advanced tasks use Copilot Credits. Create or review your cost management policy in the Microsoft 365 admin center before the pilot grows. Our Microsoft 365 Copilot licensing changes guide explains the billing model.

Save this decision table. It is the fastest way to agree hero link defaults with site owners and your security team.

How do you tie Copilot in OneDrive spend to measurable value?

Measure hours returned on one recurring task before and after the pilot, then compare that value with what the licenses and any Copilot Credits cost. A single, well-chosen workflow usually tells you more than a tenant-wide usage chart.

Here is a simple worked example with illustrative numbers. Replace them with your own.

• 40 managers each spend 6 hours a month building a monthly business report from spreadsheets, notes and last month's report.
• With Copilot in OneDrive analyzing the files and a saved custom skill building the HTML report, that drops to 2 hours each. That is 4 hours saved per manager, or 160 hours a month.
• At a loaded cost of $75 an hour, 160 hours is worth $12,000 a month, or $144,000 a year.
• Compare that with what you already pay for those 40 Microsoft 365 Copilot licenses plus any Copilot Credits the workflow consumes. If the value is several times the cost, scale it to the next team. If not, change the workflow before you change the license count.

On the sharing side, track two numbers for 90 days: the count of hero links widened to the organization on sensitive sites, and sharing-related help desk tickets. The first should stay near zero. The second should fall. For a fuller scorecard, see our guide to Copilot adoption metrics that prove value.

What do IT leaders ask most about OneDrive hero links?

Four questions come up in almost every conversation about this change. Here are short, direct answers.

Do we need to do anything before hero links roll out?

Microsoft says no user action is required before the rollout, but admins should review sharing guidance, communicate the change and set site-level defaults where different behavior is needed. Hero links start at "Only people added to the file," so the main risk is users widening links without understanding the new dialog.

Do our existing link expiration policies apply to hero links?

No. Microsoft states that existing default sharing link settings and link expiration policies apply to legacy links only. Microsoft has announced expiring hero link controls as coming soon, for example expiring organization-wide hero links after 90 days.

Is Copilot in OneDrive included in the Microsoft 365 Copilot license?

Everyday capabilities, such as asking questions about your files, creating and organizing content and building reusable skills, are included with the Microsoft 365 Copilot license. Large-scale and advanced tasks use Copilot Credits, which admins control through spending policies in the Microsoft 365 admin center.

Will our old sharing links stop working?

No. Existing links keep working and appear under "Other links" in the new sharing dialog. Review them as part of normal access reviews, especially Anyone links on sensitive sites.

How can 2toLead help you prepare for hero links?

2toLead helps organizations across nonprofit, education, government, healthcare and professional services turn Microsoft 365 changes into governed, measurable outcomes. In a fixed-scope, three-week Hero Link and Copilot in OneDrive Readiness Sprint, our Microsoft MVP team will:

• Map your sensitive sites and agree a hero link default for each one
• Apply DefaultMainLinkScope settings and document the legacy policy gap in your risk register
• Run an oversharing review with the SharePoint Admin Agent and SharePoint Advanced Management
• Deliver a ready-to-send user briefing on the new sharing dialog for champions and managers
• Pilot Copilot in OneDrive on one recurring workflow and hand you a simple value scorecard

Read more practical guidance on the 2toLead Insights hub, including our walkthrough of the SharePoint agents upgrade before March 2027, or book a Hero Link and Copilot in OneDrive Readiness Sprint.

No hype. Just practical, governed AI that actually gets adopted.