SharePoint external sharing

External sharing in SharePoint and OneDrive is one of the most useful and most dangerous features in Microsoft 365. Useful, because the alternative is people emailing attachments or reaching for personal Dropbox accounts. Dangerous, because a link created in three clicks can expose content indefinitely to people you'll never audit. The feature is governed by layered controls, and running a sane tenant means knowing where each layer kicks in.

The four levels of sharing

The tenant-wide sharing setting — and the per-site setting beneath it — takes one of four levels:

1. Anyone — anyone with the link, no sign-in required. The most permissive.
2. New and existing guests — external recipients sign in with their own account or a one-time passcode, and a guest account is created in your directory.
3. Existing guests only — only people already in the directory as guests can be invited.
4. Only people in your organisation — no external sharing at all.

The tenant-wide level is a ceiling: each site can match it or be more restrictive, never more permissive. SharePoint and OneDrive have separate tenant-level settings, with OneDrive capped by the SharePoint level.

The right mental model: set the tenant ceiling to the most permissive level any site legitimately needs, then govern per site. A tenant locked to "Only people in your organisation" doesn't stop external collaboration — it just pushes it to email attachments and shadow IT, which are worse in every measurable way.

"Anyone" links

"Anyone" links deserve their own paragraph because they're the level that bites. Recipients don't sign in, so access can't be attributed to a person, the link forwards freely, and revoking it is the only remediation. If you allow them at all:

• Set an expiration (the tenant setting supports forcing one — 30 days is a common choice).
• Restrict them to view-only for files.
• Reserve them for genuinely public-ish content, and use "Specific people" links for real collaboration.

Many security teams disable Anyone links tenant-wide and lose very little; "New and existing guests" covers almost every real scenario with an identity attached.

Guests are directory objects

Guest sharing creates B2B guest accounts in Entra ID, which means guests are governed by identity controls, not just SharePoint settings: Conditional Access applies to them, cross-tenant access settings decide which home tenants you trust, and access reviews can recertify them. That's the strength of guest-based sharing over anonymous links — see Entra ID B2B guest access for the identity side, and the external-collaboration umbrella guide for how SharePoint, Teams, and Entra settings interlock.

Guests also drift. Someone shares a folder with a supplier in 2024; the project ends; the guest account and its access remain. Guest expiration policies in SharePoint (access expires after N days unless renewed) plus inactive-guest cleanup in Entra ID are essential hygiene. A typical policy removes or reviews guests inactive for 90–180 days.

Default link types matter more than ceilings

Users take the default. If the default sharing link is "People in your organisation," most sharing stays internal even when guests are allowed; if it's "Anyone," everything leaks by default. Set the tenant default to "Specific people" or "People in your organisation" and let users deliberately choose broader links when they need them. This single setting does more for your exposure than most of the others combined.

Sensitivity labels for sites

The modern way to govern site-level sharing is with sensitivity labels applied to the SharePoint site (via the underlying Microsoft 365 Group or Team). A container label can enforce:

• The maximum external sharing level for that site.
• Whether unmanaged devices get full access, web-only, or blocked.
• The default sharing link type and permission (View vs Edit).
• Guest access to the connected Team.
• A Conditional Access authentication context for the site.

This moves governance out of a per-site admin chore and into the classification flow users already perform: label the site "Confidential," and the sharing posture follows. The taxonomy design lives in the sensitivity labels deep dive.

SharePoint Advanced Management

SharePoint Advanced Management — included with Microsoft 365 Copilot licences, otherwise an add-on — is the reporting and enforcement layer: data access governance reports that show which sites are shared externally and how heavily, restricted access control to lock high-risk sites to a defined group, block-download policies, and site access reviews delegated to site owners. If you inherited a tenant with years of uncontrolled sharing, its reports are where remediation starts.

A baseline that works

For a typical business tenant:

1. Tenant ceiling: New and existing guests. Anyone links off, or view-only with forced expiration.
2. Default link: Specific people.
3. Guest expiration on, with 90–180 day inactivity cleanup in Entra.
4. Sensitivity labels on sites, with the "Confidential" tier blocking external sharing.
5. OneDrive one notch stricter than SharePoint — personal shares need less reach.
6. Quarterly review of the SAM oversharing reports.

None of this blocks collaboration; all of it bounds the blast radius. And if Microsoft 365 Copilot is anywhere on your roadmap, this work is a prerequisite, not a nice-to-have — Copilot makes overshared content discoverable at conversational speed, and external sharing is the sharpest edge of that problem.