Key takeaways

  • Microsoft describes three main link types: Anyone, People in your organization, and Specific people. An Anyone link works for whoever has it without signing in, and access through it cannot be audited.
  • External sharing in SharePoint and OneDrive is on by default for the environment, and a site cannot be more open than the organization-level setting; the most restrictive value applies.
  • Link expiration is an administrator setting. When a link expires only the link stops working; the file and other permissions are unchanged.
  • Sensitivity labels can apply to Teams, Microsoft 365 groups and SharePoint sites to control privacy, external user access and external sharing, and they work with Conditional Access for unmanaged devices.
  • Do the audit in four passes: tenant settings, sites, guests, then files and links. Fix defaults first so you are not mopping with the tap running.

Why sharing links are worth an audit

Staff share files because it is the fastest way to work with clients and vendors. Each share creates a link or a permission, and almost none are removed when the project ends. Microsoft's own description of link types gives the main risk: an Anyone link gives access to anyone who has it, they do not have to sign in, and their access cannot be audited. It is a transferable secret: if the link is forwarded, the new person has the same access. Specific-people links are not transferable, which makes them a safer default.

Pass 1: Tenant settings

In the SharePoint admin center, check the organization-level external sharing setting. Microsoft's documentation notes that external sharing is on by default for the whole SharePoint and OneDrive environment, and that if a site's setting and the organization setting differ, the most restrictive applies. Decide the loosest level you really need:

  • Anyone: only if you have a real reason, such as publishing large public files, and even then think about limiting it to specific sites.
  • New and existing guests: people outside sign in or verify with a code.
  • Existing guests only: no new invitations from users.
  • Only people in your organization: external sharing off.

Then set the default link type to Specific people or People in your organization, so that clicking Share does not create an Anyone link by habit. Set link expiration for Anyone links and, if your plan supports it, for People in your organization links, and set Anyone links to view-only unless editing is truly needed. Remember that expiry is not retroactive in every case: Microsoft explains how older links are evaluated against their creation date, so test on one site first.

Pass 2: Sites and Teams

List all sites and Teams-connected sites with their sharing setting, owner and last activity. The SharePoint admin center and the data access governance reports can show sites with the most sharing, such as those with many sharing links or many guests; run them and review the top of the list. For each site, ask: does this site need external sharing at all? Sites that hold HR, finance, legal or client files should be set to the most restrictive level their purpose allows. Every site and team needs at least two owners so that someone can answer questions about it.

For Teams, review guest access in the Teams admin center and the guest settings in Microsoft Entra, and review the difference between guests in a team and external access, which is chat with another organization's users. Shared channels let you work with people from other organizations without adding them as guests of the whole team, which can be a narrower option.

Pass 3: Guests

Export the guest list from Microsoft Entra: who they are, which organization, when they last signed in, and which groups they belong to. Remove guests who have not signed in for a set time, for example 90 days. Microsoft Entra access reviews can ask the owners of a team to confirm guests on a schedule, and remove guests that no one confirms. That one automated task does more for guest hygiene than a yearly manual cleanup.

Pass 4: Links and files

Use the sharing reports and the audit log to find the links that matter: Anyone links on files that carry sensitive words or labels, links that are old, links created by people who have since left, and files shared with personal email addresses. Microsoft Purview's audit log records sharing activity such as links created and guests invited, so you can see how widely a file was shared and when. For each risky link, either remove it, replace it with a Specific people link, or set an expiry. Tell the owner why; most are happy to fix it.

Take care with Microsoft 365 Copilot and search. Microsoft notes that a Specific people link makes the item searchable and available to Copilot for those people, while an Anyone link does not show up in search until someone redeems it. Over-broad permissions inside the organization are a separate problem; our article on Copilot readiness covers it.

Sensitivity labels: set the rules once

A sensitivity label can protect files and emails, and also containers: Teams, Microsoft 365 groups and SharePoint sites. The container settings include privacy (public or private), external user access, external sharing from the site, and access from unmanaged devices (which works with Conditional Access). A site labeled Confidential can then be private, closed to guests and limited to managed devices automatically, instead of relying on each site owner to remember. Microsoft notes that when label settings allow site owners to change external sharing or authentication contexts, site owners can set them by changing the label, so design the label set and who may change it carefully.

Keep it clean

  • Repeat the review every quarter; the guest access review can run on its own schedule.
  • Tell staff in one page what to use: Specific people links by default, expiry on, no personal email addresses for clients where a guest account is possible.
  • Make a short list of exceptions that were approved, who approved them, and when they end.
  • If you are subject to client or regulatory confidentiality duties, record the review as evidence.

We run this audit for Microsoft 365 tenants as scoped, authorized work: the findings list, the settings we would change and why, and the changes themselves once you approve them.

Sources

This article is general information, not legal or technical advice for your environment. Microsoft 365 features, defaults and license requirements change; check Microsoft's current documentation for your plan before changing settings. Last reviewed .

Next article

Related reading

Need help with this?

We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.

Managed IT Services