Tighten sharing links in Microsoft 365

Disable anonymous “Anyone” links

• Open the SharePoint admin centre.
• Select Policies from the left menu.
• Select Sharing.
• Under External sharing, locate the sliders for SharePoint and OneDrive.
• Move the SharePoint setting to New and existing guests. This permits legitimate external collaboration, but recipients must sign in or verify their identity.
• Set OneDrive to either New and existing guests for normal external collaboration, or Existing guests if users should only share with guests already approved in your directory.
• Do not select Anyone. This option creates anonymous links that can be forwarded and used without authentication.
• Select Save.

The OneDrive setting can be equally restrictive or more restrictive than SharePoint, but it cannot be less restrictive. Microsoft advises that changes may take approximately one hour to fully apply.

Change the default link to “Specific people”

This reduces accidental oversharing when a user selects Share.

• Remain in SharePoint admin centre → Policies → Sharing.
• Scroll to File and folder links.
• Under Choose the type of link that’s selected by default when users share files and folders, select Specific people.
• Under default link permissions, select View.
• Users can still deliberately grant editing access when it is required and permitted.
• Select Save.

Configure guest access expiration

• In Policies → Sharing, expand More external sharing settings.
• Find Guest access to a site or OneDrive will expire automatically after this many days.
• Enable the setting.
• Enter an appropriate period: 60 days for higher-security environments, or 90 days for ordinary business collaboration.
• If displayed, configure people using verification codes to reauthenticate periodically. A period of approximately 30 days is a reasonable starting point for reauthentication.
• Select Save.

Site owners may be prompted to extend legitimate guest access before it expires.

Restrict who can share externally

For stronger control, allow only approved staff to initiate external sharing.

• Go to SharePoint admin centre → Policies → Sharing.
• Expand More external sharing settings.
• Select Allow only users in specific security groups to share externally.
• Select Manage security groups.
• Add the security group containing authorised users, such as External Sharing Approved Users.
• For each group, select Authenticated guests only.
• Select Save.

Review each SharePoint site

Organisation-wide settings establish the maximum sharing level. Individual sites can be configured more restrictively.

• Open SharePoint admin centre.
• Select Sites → Active sites.
• Review the External sharing column.
• Pay particular attention to sites containing financial information, payroll or employee records, client information, legal documents, medical or health information, passwords or technical documentation.
• Select a site.
• Open Settings.
• Select More sharing settings.
• Choose the appropriate level: Only people in your organisation for confidential internal sites, Existing guests for tightly controlled collaboration, or New and existing guests where external collaboration is genuinely required.
• If external access is limited to trusted partners, expand Advanced settings for external sharing and configure allowed or blocked domains.
• Confirm the default sharing link is Specific people and the default permission is View.
• Select Save.

A site cannot be configured more permissively than the organisation-wide setting.

Review existing external users and access

Changing the default link type does not automatically prove that all existing permissions are appropriate.

Review site access

• For each important SharePoint site, open the site.
• Select Settings → Site permissions.
• Select Advanced permissions settings or review the displayed owners, members and visitors.
• Look for external email addresses, guest accounts, unexpected groups, former suppliers or contractors, and users who no longer need access.
• Remove unnecessary access.
• For individual files or folders, select the item and then Details → Manage access.
• Remove obsolete users and delete unnecessary sharing links.

Review guest accounts

• Open the Microsoft 365 admin centre.
• Go to Users → Guest users.
• Review each guest account.
• Confirm who invited the guest, which organisation they represent, whether access is still required, and whether their access is appropriately limited.
• Remove guest accounts that no longer have a legitimate business requirement.

Audit sharing activity

• Open the Microsoft Purview portal.
• Select Solutions → Audit.
• Create a new search.
• Under activities, select Sharing and access request activities.
• Select an appropriate date range.
• Run the search.
• Review or export the results.
• Pay particular attention to AnonymousLinkCreated, AnonymousLinkUsed, SharingInvitationCreated, SharingInvitationAccepted, SecureLinkCreated and AddedToSecureLink.
• Look for unusual volumes of external sharing and sensitive files shared outside the organisation.

Organisations with suitable SharePoint Advanced Management or Microsoft 365 E5 licensing may also use SharePoint admin centre → Reports → Data access governance. The sharing-links and site-permissions reports can help identify overshared sites. Microsoft recommends baseline permission reviews quarterly and recent sharing-activity reviews monthly.