What this check looks at
Lists files and folders in people’s OneDrives and Microsoft 365 groups’ libraries shared by an “Anyone” link, which opens without signing in. Communication sites with no group are not read.
OneDrive and SharePoint offer three kinds of sharing link: one that only named people can use, one that anyone in the organisation can use, and an Anyone link that opens the file for whoever has the address, with no sign-in. An Anyone link to a folder opens everything in it, including files added later.
This check walks each person’s OneDrive and each Microsoft 365 group’s files (every Team has one) and lists the files and folders that carry an Anyone link. It reads only names, addresses and the sharing marker, never the content. Communication sites with no group are not read, and a library that refuses the read is said, not counted as clear.
An Anyone link is forwarded, pasted into tickets and chats, and saved in browser history and mail archives. Nothing records who opened it, and it keeps working after the reason for it has gone, so a link made for one supplier years ago can still open payroll today.
Why it matters
An Anyone link works for whoever has it: forwarded, posted or guessed, it opens the file with no sign-in and no record of who looked. Old links to payroll exports or client lists are a common way data leaves a business without anyone noticing.
A typical case: a finance assistant shares a folder with the accountants using an Anyone link so they do not need an account. Two years later the folder holds every payslip, the link is in an old email thread that was forwarded to a personal address, and nobody can say who has opened it. The firm has to treat it as a data breach and tell the ICO.
Most Anyone links are made in good faith and some are still needed. The fix is a short conversation with each owner, then removing the links nobody needs and making the rest expire.
CIS Microsoft 365 Foundations Benchmark 7.2.3 asks for external content sharing to be restricted. ISO 27001 A.5.14 and A.8.12, the NCSC CAF’s data security outcome (B3.b) and NIST CSF PR.DS-02 support it.
How to fix it
Where: SharePoint admin centre → Policies → Sharing
Before you start
- Ask each owner whether the link is still needed: some are for a supplier or an accountant on purpose.
- For a listed folder, check what is in it: everything inside is open through the same link.
Step by step
- Ask each owner about their links. Send each person or Team owner the files listed in the evidence and ask which links are still needed and by whom. A folder link deserves the closest look, since it opens everything inside.
- Remove the links nobody needs. In OneDrive or SharePoint, select the file or folder, choose Manage access, then under Links select the Anyone link and Remove link. Anyone using it is then asked to sign in.
- Replace the ones still needed. Share again with Specific people, entering the supplier’s email address: they confirm with a code sent to that address, and the share shows who it was for.
- Make the remaining links expire. In the SharePoint admin centre, go to Policies > Sharing, and under Choose expiration and permissions options for Anyone links set links to expire within 30 days. Changing the default link type to Specific people stops most new Anyone links being made by accident.
- Turn Anyone links off if nobody needs them. If no one needs them, set External sharing for SharePoint and OneDrive to New and existing guests. This switches off every Anyone link at once, so tell the owners first.
- Confirm the change. The files you dealt with no longer appear in the evidence at the next assessment.
What users will notice
Whoever was using a removed link can no longer open the file; they are asked to sign in, or to ask the owner for a new link.
How to confirm it worked
The files in the evidence no longer appear at the next assessment, and the SharePoint admin centre shows Anyone links set to expire, or turned off.
Frameworks and controls
This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.b Data in transit |
| DSPT | Standard 1: Personal confidential data |
| Microsoft Cloud Security Benchmark | DP-2 Monitor anomalies and threats targeting sensitive data |
| Zero Trust | Data |
| SOC 2 | CC6.7 Restricting the transmission, movement and removal of information |
| NIST SP 800-171 | 3.1.3 Control the flow of CUI in accordance with approved authorisations |
| CMMC Level 2 | AC.L2-3.1.3 Control CUI Flow |
| ISO 27001:2022 | A.5.14 Information transferA.8.12 Data leakage prevention |
| CIS M365 | 7.2.3 Ensure external content sharing is restricted |
| CIS Controls v8.1 | 3.13 Deploy a data loss prevention solution (IG3) |
| NIST CSF 2.0 | PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Manage sharing settings for SharePoint and OneDrive (Microsoft Learn)