How should we configure external sharing in Microsoft 365?

Key facts

• SharePoint and OneDrive sharing levels run from Anyone to Only people in your organization.
• A site can be more restrictive than the tenant setting, never more open.
• OneDrive sharing cannot be more permissive than the SharePoint tenant setting.
• Anyone links need no sign-in, so set expiration and limit them to view where allowed.
• Teams guest access depends on Entra B2B settings and SharePoint sharing settings together.

Understand the layers

External sharing in Microsoft 365 is not one switch. It is a stack of settings that all have to allow an action before it works. Microsoft Entra ID external collaboration settings control who can invite guests. The SharePoint admin center sets the tenant limit for SharePoint and OneDrive. Each site then has its own sharing level. Teams has guest access and external access settings of its own.

Because the layers interact, a change in one place can quietly open or block sharing elsewhere. Document the intended design before changing anything, and test with a real external account.

Choose the tenant-wide level

The four SharePoint levels are Anyone, New and existing guests, Existing guests, and Only people in your organization. Most businesses that work with clients, vendors or partners set the tenant to New and existing guests, which requires external people to sign in or verify with a code, so every access is tied to an identity.

Allow Anyone links only if there is a real business need, such as sending large files to the public, and then confine them to a few sites. Use the domain allow or block list if you share mainly with known partners.

Set safer defaults for links

Defaults matter because most users accept whatever the share dialog suggests. Microsoft has been simplifying the sharing experience, so check the current options in your tenant, but the principles stay the same.

• Default link type: Specific people, or People in your organization for internal collaboration.
• Default permission: View rather than Edit.
• Anyone links, if allowed: set an expiration in days and limit them to view for files and folders.
• Guest access expiration: require guests to be re-shared with after a set number of days.
• Require guests to sign in with the same account the invitation was sent to.

Handle sensitive sites differently

Some sites should never be shared externally: HR, finance, legal, board material. Set those sites to Only people in your organization, or apply a sensitivity label for containers that sets the external sharing level and guest access for the site, group and team automatically.

SharePoint Advanced Management adds data access governance reports, site access reviews and restricted access controls that help find oversharing at scale. Purview DLP policies can also block or warn when sensitive information types, such as financial account numbers, are shared outside the organization.

Review sharing on a schedule

Sharing drifts. Run the SharePoint sharing reports or data access governance reports to find sites with many Anyone links or external users. Ask site owners to confirm external access quarterly. Pair this with guest access reviews in Entra ID so old guests do not keep access forever.

When tightening settings, communicate first. Changing the default link type or adding expiration can surprise teams that rely on existing links, so announce the change, give a date, and point people to the right way to share with clients.

How Accred Consulting approaches it

Accred Consulting designs external sharing as part of SharePoint governance and security projects. Discovery reviews current Entra, SharePoint, OneDrive and Teams settings, finds existing Anyone links and guests, and maps which teams genuinely share outside. The proposal sets a clear scope, fixed price and timeline. US-based specialists then set tenant and site levels, safer link defaults, container labels for sensitive sites and a review cadence, with communication to users. A roughly 240-user organization ended with 11 governed sites after this kind of work. Handover includes documentation and knowledge transfer.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions