How to restrict external sharing for a SharePoint site

Restricting external sharing for a SharePoint site is one dropdown in the SharePoint admin center — Anyone, New and existing guests, Existing guests, Only people in your organization — plus the default link type and expiration settings that decide how sharing behaves when it is allowed. The trap is the second half: the setting stops new sharing, but every guest and link created before you changed it still works until you find and remove it.

The model — how site sharing sits under tenant sharing, how OneDrive differs, and how Entra B2B and Teams guest access relate — is in SharePoint external sharing and the wider external collaboration map. If you are here because something was shared with the wrong people, the exposure runbook comes first; this page is the preventive setting.

Prerequisites

• SharePoint Administrator role (site owners cannot change a site's external sharing level; they can only share within it).
• Knowledge of the tenant-level setting: SharePoint admin center → Policies → Sharing. It is the ceiling for every site.
• A list of who currently has external access to the site, before you change anything: SharePoint admin center → Reports → Data access governance → Sharing links or, per site, Site permissions → Guest expiration / external users.
• If the site is connected to a Team or Microsoft 365 group: the group's guest setting (Entra → Groups → the group, or a sensitivity label on the group) also controls guest membership, separately from file sharing.

Steps

1. Set the tenant ceiling (once)

SharePoint admin center → Policies → Sharing. For most organisations: SharePoint = New and existing guests, OneDrive = New and existing guests or Existing guests. Under More external sharing settings: Limit external sharing by domain if you have a partner allow-list; Guests must sign in using the same account on; Allow guests to share items they don't own off. Under File and folder links: default link type Specific people, default permission View; if Anyone links must exist, set These links must expire within 30 days and View only.

2. Restrict the site

SharePoint admin center → Sites → Active sites → the site → Settings (or the Sharing tab) → External sharing. Choose Only people in your organization for internal-only sites, or Existing guests for a site that should keep its current partners but stop new ones. Save. With PowerShell:

Connect-SPOService -Url https://contoso-admin.sharepoint.com
Set-SPOSite -Identity https://contoso.sharepoint.com/sites/Finance -SharingCapability Disabled
# Or: ExistingExternalUserSharingOnly | ExternalUserSharingOnly | ExternalUserAndGuestSharing

For a batch of sites, pipe Get-SPOSite -Limit All | Where-Object {...} into Set-SPOSite.

3. Tighten the site's link defaults

Same page: Default sharing link type → Specific people, Default link permission → View. Even on a site that allows guests, these defaults stop the "I'll just send a link" reflex from producing organisation-wide edit links.

4. Remove existing external access

From the site: Settings (gear) → Site permissions → (three dots) Manage access / External users lists guests with access; remove those who should not have it. For sharing links, run the sharing report: Site settings → Site usage → Shared with external users → Run report (or the admin-center Data access governance report) and delete links from each item's Manage access pane. Anyone links can be killed tenant-wide by disabling them; specific-people links to external users are removed by removing the guest.

For the Team- or group-connected site, remove guests from the group too (Entra → Groups → Members) or they retain membership-based access.

5. Set guest expiration

SharePoint admin center → Policies → Sharing → Guest access to a site or OneDrive will expire automatically after → 30–90 days. Owners get a renewal prompt; unrenewed guests lose access. This is the control that keeps step 4 from needing to be repeated every quarter. Pair it with an access review of guests if you have P2.

Verify

• As a site member, try to share a file with an external address: the sharing dialog refuses with "your organization's policies don't allow you to share with these users" (or only offers existing guests).
• Get-SPOSite -Identity <url> | Select SharingCapability,DefaultSharingLinkType,DefaultLinkPermission shows the values you set.
• The sharing report for the site shows no external users or links you did not intend to keep.
• The audit log shows SharingSet / AnonymousLinkCreated events stopping for the site after the change.

Roll back

Set the site's external sharing back to the previous level — instantly effective for new sharing. Removed guests must be re-invited (their guest account in Entra still exists unless you deleted it; re-sharing to the same address re-uses it). Deleted sharing links cannot be restored; new links must be created. Raising the tenant ceiling affects every site that inherits the tenant setting, so check which sites do before touching it.