Microsoft 365 SharePoint external sharing — what it means and how to lock it down

← All articles

By default, SharePoint Online and OneDrive in Microsoft 365 allow users to share files with people outside your organisation — including anyone with a link, without requiring a sign-in. For most businesses, this is far too permissive.

The four sharing levels

Microsoft 365 has four levels of external sharing, from most to least permissive:

1. Anyone — users can share files using links that don't require sign-in. Anyone who gets the link can access the file, even if they weren't the intended recipient.
2. New and existing guests — users can share with external people who must sign in or verify their identity via a one-time passcode.
3. Existing guests only — sharing is limited to people already in your Azure AD guest list.
4. Only people in your organisation — no external sharing at all.

What setting should you use?

For most businesses: New and existing guests is the right balance. It allows legitimate external collaboration while requiring recipients to verify their identity. Sensitive industries (legal, financial, healthcare) should consider Existing guests only or Only people in your organisation for most sites.

How to change your SharePoint sharing policy

1. Go to the SharePoint Admin Centre (admin.microsoft.com → All admin centres → SharePoint)
2. Click Policies → Sharing
3. Under "External sharing", set the slider for both SharePoint and OneDrive to your chosen level
4. Click Save

You can also set different policies at the site collection level — useful if most of your SharePoint is internal but you have a specific collaboration site for external partners.

Additional controls worth enabling

• Require guests to sign in with the same account sharing was sent to — prevents link forwarding
• Allow only users in specific security groups to share externally — limits who can share outside the org
• Set guest access to expire — automatically removes external access after a set period
• Default link type to "Specific people" — changes the sharing dialog default from "Anyone" to named recipients

How to check your current setting

M365Clarity scans your SharePoint sharing policy as part of every scan and flags it red if it's set to "Anyone" (unauthenticated access permitted), amber if it's "New and existing guests", and green if it's restricted to existing guests or internal only.

Related articles