Locking down SharePoint and OneDrive external sharing

SharePoint and OneDrive each have an organization-wide external sharing setting, managed in the SharePoint admin center. The OneDrive setting can be the same as or more restrictive than the SharePoint setting, never more permissive, and each site can be set the same as or more restrictive than the organization. Microsoft Learn's "Manage sharing settings for SharePoint and OneDrive" documents each level.

Anyone links are the riskiest option because they cannot be traced to a person. A forwarded link works for whoever receives it, and you cannot tell who opened it. Microsoft notes you cannot track who has access to shared items when Anyone links are used.

For law, accounting, HR and health practices, the safer default is to turn Anyone links off and use "New and existing guests", where the recipient must authenticate. If the business genuinely needs Anyone links (large file delivery to the public, for example), restrict them: set them to expire after a set number of days, allow View only, and limit them to specific sites.

• Default link type: set to "Specific people" so staff must choose recipients, rather than "Only people in your organization" or "Anyone with the link".
• Default permission: View, not Edit. Users can still upgrade a link when they need collaboration.
• Guest access expiry: SharePoint can make guest access to a site or OneDrive expire after a set number of days, so old guests age out instead of keeping access for years.
• Organization link expiry: admins can now set expiration for "People in your organization" links too; existing links are evaluated against the policy when used.
• Re-authentication: require guests using verification codes to re-authenticate after a set period.

Set the organization level to the most permissive setting you need anywhere, then tighten individual sites. A typical pattern: organization allows New and existing guests; client collaboration sites keep that; HR, finance, leadership and board sites are set to Only people in your organization; one marketing site is allowed Anyone links if truly needed.

Guest settings on Microsoft 365 Groups and Teams also affect connected SharePoint sites, so check both. Sensitivity labels applied to sites can enforce these external sharing settings automatically, which stops a site owner from loosening them later.

Guests accumulate. Every past client, contractor and opposing party who was ever shared a file can remain in your directory. Review them at least quarterly.

With the appropriate Microsoft Entra ID Governance or P2 licensing, Access Reviews can ask site or team owners to confirm each guest still needs access and remove those who are not confirmed. Without those licences, export guest users from Entra ID, sort by last sign-in, and remove or block those who have not signed in for months. Record who reviewed what and when; that record is evidence of the PIPEDA safeguards principle in practice.

1. 01

   Run sharing reports

   SharePoint can produce a sharing report for a site or OneDrive listing items shared through links and with guests.

2. 02

   Search the audit log

   Sharing events (links created, guests invited, Anyone links used) are recorded in the Microsoft 365 audit log for investigation.

3. 03

   Prioritize sensitive locations

   Start with HR, finance, client and leadership sites rather than every OneDrive.

4. 04

   Remove or convert risky links

   Delete Anyone links that are no longer needed; replace with Specific people links.

5. 05

   Change settings, then communicate

   Tell staff what changed and how to share with clients properly.