If your Microsoft 365 tenant is set to allow "Anyone" links — which is the Microsoft default for many tenants — then any user in your organisation can share any file with anyone on the internet, with edit access, no expiry, and no way for the recipient to be required to sign in. The file is effectively public.
Most small and medium businesses have no idea their tenant is configured this way. It's a default setting that Microsoft ships to reduce friction for new users, and it doesn't generate any alerts when it's used. The first time many businesses discover it is after a data incident.
The worst combination: sharingCapability = ExternalUserAndGuestSharing + defaultSharingLinkType = AnonymousAccess + defaultLinkPermission = Edit
This means every new share link is an anonymous edit link by default. A user sharing a file in Slack or Teams accidentally uses this link. The recipient forwards it. The document is now indexed by Google within 48 hours.
SharePoint external sharing posture is determined by six settings in the SharePoint tenant administration API. Understanding each one tells you exactly what your exposure is.
| Setting | What it controls | Safest value |
|---|---|---|
sharingCapability | Who can receive external shares | ExistingExternalUserSharingOnly |
defaultSharingLinkType | What type of link is created by default | Direct (specific people) or Internal |
defaultLinkPermission | Whether default links grant view or edit | View |
sharingDomainRestrictionMode | Whether sharing is limited to specific domains | AllowList with partner domains |
preventExternalUsersFromResharing | Whether guests can forward your files | true |
requireAcceptingUserToMatchInvitedUser | Whether the recipient must sign in as the invited address | true |
Critical: sharingCapability is ExternalUserAndGuestSharing (Anyone links) with AnonymousAccess as the default link type and Edit as the default permission. Maximum data leakage risk.
High: Anyone links enabled, but default link type is Internal or Direct. Users have to deliberately choose to create an anonymous link — but they can, and some will.
Medium: External guest sharing enabled (ExternalUserSharingOnly) but no guardrails — guests can reshare, no domain restriction, no match requirement.
Low: Sharing restricted to existing guests only (ExistingExternalUserSharingOnly) or disabled entirely, with resharing blocked and recipient match required.
The quickest way is the SharePoint admin centre. Go to admin.microsoft.com → SharePoint → Policies → Sharing. The "External sharing" slider shows your sharingCapability. The "File and folder links" section shows your default link type and permission.
M365Clarity scans these settings automatically and displays them in the Teams & SharePoint tab, including an AI-generated posture assessment that explains what your specific combination of settings means in plain English — not just whether each setting is green or amber, but what the combination actually exposes you to.
If you're currently at critical risk, the single highest-impact change is setting the default link type to "People in your organisation" (Internal). This doesn't remove the ability for users to create external links — it just means they have to consciously choose to do so. The number of accidental external shares drops dramatically.
The second change is setting sharingCapability to ExistingExternalUserSharingOnly. This removes the ability to create anonymous links entirely. Only authenticated guests who already exist in your directory can receive shares. This is the right default for most SMBs — external collaboration still works, but it requires the recipient to have a Microsoft account and sign in.
Enable preventExternalUsersFromResharing at the same time. It's a single toggle and it stops guests from forwarding your files to anyone else.
Communicate before you change. If your organisation regularly shares files externally using Anyone links, removing that capability without warning will cause immediate complaints. Tell users in advance, explain why, and provide an alternative workflow — usually "share with specific people" using the recipient's email address.
M365Clarity's SharePoint AI Sharing Posture feature assesses all six settings above and returns a risk level, a plain-English explanation of what your specific configuration means, a breakdown of each risk with severity, what is configured well, and a prioritised list of recommended actions with effort ratings. The analysis is generated by Claude using your actual tenant data — not generic advice.
The feature is available to Pro plan subscribers and can be found under Security & Compliance → Teams & SharePoint → AI Sharing Posture.
Check your SharePoint sharing posture
Scan your tenant and get an AI assessment of your external sharing risk in under 2 minutes.
Run a free scan →