SharePoint and OneDrive External Sharing: The Settings to Check in Microsoft 365

Data does not need an attacker to leave a Microsoft 365 tenant. A sharing link is enough: a folder shared with "Anyone" for a project two years ago, a guest who reshared a file, a laptop at home that synced the whole finance library. SharePoint and OneDrive have a small number of settings that decide how easy that is. This guide covers each one, what we recommend, and where to change it.

All the organization-wide settings below are in the SharePoint admin center → Policies → Sharing, unless noted.

1. The external sharing level

This is the main control. SharePoint and OneDrive each have a slider with four levels:

• Anyone — users can create links that work for anyone, with no sign-in;
• New and existing guests — people outside the company must sign in or use a verification code;
• Existing guests — only guests already in your directory;
• Only people in your organization — no external sharing.

Recommendation: for most businesses, New and existing guests is the right level for SharePoint. Every external person then has to prove who they are, and you can see who has access. Choose Anyone only if you have a clear need for anonymous links, and then set the expiry and permission limits in section 2. OneDrive can be set to the same level or stricter, never more permissive than SharePoint; many companies set OneDrive to Existing guests so that personal storage is not the easy way out.

Individual sites can be stricter than the organization setting, never more permissive. Use that for sites that hold HR, finance or legal data.

Checks: CIS-2.1.1, SharePoint external sharing restricted; CISA-SPO-1.2, OneDrive external sharing restricted to existing guests or less.

2. Anyone links: expiry and permissions

If you allow Anyone links, limit the damage a forwarded link can do:

• Expiry: set "These links must expire within this many days" to 30 days or less. A link without an expiry keeps working long after the project ends.
• Permissions: set Anyone links for files and folders to View. An editable anonymous link lets anyone who finds it change or replace your files.

Check: CIS-2.1.3, Anyone link expiration configured (≤30 days).

3. The default link type and permission

When a user clicks Share, the link type that is selected by default is the one most people use. Under File and folder links:

• set the default link type to Specific people, so a link works only for the people it was sent to;
• set the default permission to View, so editing is a deliberate choice.

Users can still choose a wider link when they need one. The default only stops the widest link being the easy path.

Checks: CIS-2.1.4, Default sharing link type is 'Specific People'; CIS-2.1.5, Default sharing link permission is 'View'.

4. Guests resharing content

Under More external sharing settings, clear Allow guests to share items they don't own. Otherwise a guest you invited can share your file with people you never approved, and the access list stops being yours.

Check: CIS-2.1.2, Resharing by external users disabled.

5. Limit sharing to approved domains

If you mostly share with a known set of partners, use Limit external sharing by domain and allow only their domains. If you share widely, the same setting can block specific domains instead. An allow list is the stronger choice when it fits how you work.

Check: CISA-SPO-1.3, External sharing restricted to approved domains.

6. Sync only to managed devices

Sharing settings control who can open a file. Sync settings control where copies end up. In the SharePoint admin center → Settings → Sync, select Allow syncing only on computers joined to specific domains and add the GUID of each of your domains, so the OneDrive client does not copy company libraries to personal or unmanaged PCs. Pair this with a Conditional Access policy that requires a compliant or joined device (see our Conditional Access baseline).

Check: CIS-2.2.1, OneDrive sync restricted to managed devices.

Changing settings without breaking work

Tightening sharing can stop work that depends on it, so:

1. Look before you change. Review existing sharing links and guests on your busiest sites, and ask site owners which external partners they work with.
2. Tell people what will change. A short note that new Anyone links will expire, or that guests must sign in, saves support calls.
3. Change the defaults first. Default link type and permission affect only new links and break nothing.
4. Then change the limits: expiry, resharing, domains and the sharing level.
5. Remember existing links. Some changes apply only to new links. Lowering the sharing level turns off existing links that the new level does not allow, which is often the point, but check with site owners first.

How TenantVigil checks this

TenantVigil reads the SharePoint and OneDrive settings that Microsoft Graph returns and checks each control in the table below through the standard read-only Graph consent. The certificate-authenticated SharePoint connection unlocks only CISA-SPO-3.2 and CISA-SPO-3.3, which are not in this table:

Microsoft Graph does not return every one of these settings for every tenant. When a setting is not returned, TenantVigil shows that source as Not read, not as a pass or a fail. The fixes in this guide are manual changes in the Microsoft admin centers; TenantVigil does not claim to automate every setting above.

Start free to see where one Microsoft 365 tenant stands. The Free plan requires a Microsoft work-account sign-in and administrator consent and covers one tenant. For the details of what TenantVigil reads and how, see the permission model.

Further reading: Microsoft's guides to managing sharing settings for SharePoint and OneDrive and to restricting sync to computers joined to specific domains.