What this check looks at
Checks the tenant-wide external sharing capability for SharePoint and OneDrive.
The organisation-level external sharing setting in the SharePoint admin centre is the most permissive sharing any site can use, with a second slider for OneDrive that cannot be more permissive than SharePoint’s. From most to least open the levels are: Anyone (links that work without signing in), New and existing guests (people outside must sign in or confirm their address with a code), Existing guests (only people already in your directory), and Only people in your organisation. A new tenant starts at Anyone.
The check reads the tenant sharing capability through Microsoft Graph. It fails when it is Anyone (externalUserAndGuestSharing) and passes New and existing guests, Existing guests or no external sharing. CIS 7.2.3 accepts New and existing guests; CISA SCuBA MS.SHAREPOINT.1.1v1 is stricter and asks for Existing guests or only people in the organisation, which the evidence shows separately. Graph has no setting for how long Anyone links last, so link expiry is not part of the result.
An Anyone link works like a key: whoever has the URL can open the file or folder, and with an edit link change it, with no sign-in and no record of who they are. Links get pasted into emails that are forwarded, into tickets, chats and supplier portals, and stay valid until they expire or are removed. An attacker who takes over one mailbox often finds dozens of these links in sent mail, each a way into data that needs no further password.
Why it matters
"Anyone" links work without sign-in and can be forwarded indefinitely. One pasted link in a public channel or a forwarded email is an unauthenticated, permanent data disclosure that appears in no audit trail as a breach.
A typical case: an office manager shares the payroll folder with the payroll bureau using an Anyone link. The email is later forwarded to a recruitment agency as part of an unrelated thread. Two years on the link still works, and because it is a folder link it now opens every payslip added since, for every employee.
When that comes to light, the organisation cannot say who opened the files: the audit log records an Anyone link being used, with an IP address, but not by whom. Under UK GDPR it has to assume the worst, tell the affected staff and very probably report to the ICO.
CIS Microsoft 365 Foundations Benchmark 7.2.3 and CISA SCuBA MS.SHAREPOINT.1.1v1 ask for external content sharing to be restricted, and insurers ask whether sharing outside the organisation is controlled. Sharing with named outside people still works at New and existing guests.
How to fix it
Where: SharePoint admin centre → Policies → Sharing
Before you start
- Find any site that relies on Anyone links (usually a marketing or public documents site). The organisation setting caps every site, so once it is lowered no site can keep Anyone links: publish that content another way, or accept the finding with the reason.
- Check for existing Anyone links that will stop working, in the sharing report.
Step by step
- Find the Anyone links in use. In the Microsoft Purview portal, go to Solutions > Audit and search the last 90 days for the activities "Created an anyone link" and "Used an anyone link", or in Exchange Online PowerShell run Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-90) -EndDate (Get-Date) -Operations AnonymousLinkCreated,AnonymousLinkUsed -ResultSize 5000. Where SharePoint Advanced Management is available, Reports > Data access governance > Sharing links lists Anyone links by site. Note which are still being used, and by which teams.
- Decide what to do about sites that want anonymous links. Because the organisation-level setting caps every site, a site cannot keep Anyone links once the tenant is lowered. Most needs are better met another way: share with named people, or publish truly public files on the website. If one site really must keep Anyone links, the tenant has to stay at Anyone with every other site set lower, and this check keeps failing; record that decision.
- Tell the teams affected. Tell the people whose links are in use that the links will stop working on the change date, and that sharing with named outside people (who sign in or receive a code) still works.
- Lower the organisation-level sharing. In the SharePoint admin centre, go to Policies > Sharing. Under External sharing, move the SharePoint slider to "New and existing guests" (or "Existing guests" to meet CISA’s baseline as well), and move OneDrive to the same level or lower. Select Save. Existing Anyone links stop working at once.
- Make specific people the default link. On the same page, under File and folder links, set the default link type to "Specific people (only the people the user specifies)" so new shares start from the narrowest option, and select Save.
- Or make both changes in SharePoint Online PowerShell. Connect with SharePoint Online PowerShell as a SharePoint Administrator: Connect-SPOService -Url https://<tenant>-admin.sharepoint.com. Run Set-SPOTenant -SharingCapability ExternalUserSharingOnly (or ExistingExternalUserSharingOnly), then Set-SPOTenant -DefaultSharingLinkType Direct.
- If Anyone links must stay for now, limit them. Until the tenant can be lowered, at least make them expire and read-only: under "Choose expiration and permissions options for Anyone links", tick "These links must expire within this many days" and enter 30, and set file and folder permissions to View. In PowerShell: Set-SPOTenant -RequireAnonymousLinksExpireInDays 30 -FileAnonymousLinkType View -FolderAnonymousLinkType View. The check still fails while Anyone is allowed.
- Confirm the change. Run Get-SPOTenant | Select-Object SharingCapability, OneDriveSharingCapability: neither should be ExternalUserAndGuestSharing. In a SharePoint library, share a test file: "Anyone with the link" is no longer offered.
What users will notice
Links that work for anyone without signing in stop working on every site. Sharing with named external people still works.
How to confirm it worked
SharePoint admin centre, Policies, Sharing: SharePoint and OneDrive are set to "New and existing guests" or stricter.
Frameworks and controls
This check maps to controls in 14 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B3.c Stored data |
| DSPT | Standard 1: Personal confidential data |
| DORA | Art. 9(4)(c) Limiting logical access to what is required |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Zero Trust | Data |
| SOC 2 | CC6.7 Restricting the transmission, movement and removal of informationC1.1 Identifying and maintaining confidential information |
| NIST SP 800-171 | 3.1.22 Control CUI posted or processed on publicly accessible systems3.1.20 Verify and control connections to external systems |
| CMMC Level 2 | AC.L2-3.1.22 Control Public InformationAC.L2-3.1.20 External Connections |
| ISO 27001:2022 | A.5.14 Information transferA.5.15 Access control |
| CISA SCuBA | MS.SHAREPOINT.1.1v1 SharePoint external sharing limited to existing guests or the organisation |
| CIS M365 | 7.2.3 Ensure external content sharing is restricted |
| CIS Controls v8.1 | 3.3 Configure data access control lists (IG1) |
| NIST CSF 2.0 | PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protectedPR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Data security |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Turn external sharing on or off (Microsoft Learn)