SharePoint External Sharing Governance
Enterprise guide to tenant-level controls, guest access, anonymous links, conditional access, sensitivity labels, DLP, and audit for secure external collaboration.
SharePoint External Sharing for Enterprise
Quick Answer: Manage external sharing in SharePoint by controlling three levels: tenant-level policies set the maximum sharing capability, site-level overrides restrict sensitive sites, and sensitivity labels automate protection per content classification. The critical controls are: disable Anyone links (anonymous access), require guest authentication, set guest expiration to 30-90 days, enforce MFA via conditional access, deploy DLP to block sensitive content sharing, and audit monthly. EPC Group external sharing audits consistently find 20-35% of enterprise SharePoint sites have more permissive sharing than their data classification requires.
External sharing is the most powerful and most dangerous capability in SharePoint Online. It enables seamless collaboration with clients, vendors, and partners — but misconfigured sharing settings are the number one cause of enterprise data leaks in Microsoft 365 environments. A single site with anonymous link sharing enabled can expose thousands of confidential documents to the entire internet without any audit trail.
This guide provides the complete enterprise governance framework for SharePoint external sharing based on EPC Group experience securing SharePoint environments for Fortune 500 organizations across healthcare, financial services, and government. We cover every control layer from tenant policies to individual document protection.
For the foundational permissions model that external sharing builds upon, see our SharePoint Permissions Best Practices guide.
The Four External Sharing Levels
SharePoint external sharing is controlled by four levels of permissiveness. Understanding each level is essential for building a governance framework — the wrong default exposes your entire tenant to uncontrolled external access.
Anyone
Risk: CriticalAnonymous access links — no sign-in required. Cannot track individual users.
Recommendation: Disable for all sites except dedicated public content sites. Set max 7-day expiration, view-only.
New and Existing Guests
Risk: ModerateExternal users must authenticate via Microsoft account, work account, or one-time passcode.
Recommendation: Recommended as the tenant-level default. Identity verified, actions auditable, access revocable.
Existing Guests Only
Risk: LowOnly guests already in your Entra ID directory can access shared content.
Recommendation: Use for sensitive but collaborative sites. Pre-approve guests through IT workflow before sharing.
Only People in Your Organization
Risk: NoneAll external sharing blocked. Only internal users with permissions can access content.
Recommendation: Required for sites with PII, PHI, financial data, or regulated content (HIPAA, SOC 2).
Tenant-Level Sharing Controls
Tenant-level controls in the SharePoint Admin Center set the ceiling for external sharing across your entire organization. No individual site can exceed these settings — they are the foundation of your sharing governance.
Organization-Wide Sharing Level
Navigate to SharePoint Admin Center > Policies > Sharing. Set the external sharing slider to "New and existing guests" for most enterprises. This requires external users to authenticate before accessing content while allowing flexible collaboration. Only set to "Anyone" if your organization has a specific, documented business requirement for anonymous access.
Default Sharing Link Type
Set the default sharing link type to "Specific people" (not "Anyone with the link" or "People in your organization"). This forces users to specify recipients when sharing, creating an auditable trail. Users can still choose other link types within policy, but the default shapes behavior — 80% of users accept the default.
Link Expiration Settings
Set default expiration for Anyone links (7 days maximum recommended) and sharing links (30-90 days). Expiration ensures that sharing access is time-limited and does not persist indefinitely. For regulated industries, EPC Group recommends 30-day maximum for all external sharing links with no option for users to extend.
Permission Defaults for Links
Set the default permission for sharing links to "View" rather than "Edit." This follows least privilege — users who need Edit access can request it, but the default prevents external users from modifying content. Anyone links should always be restricted to View only with no option for Edit.
Domain Allowlists and Blocklists
Configure allowed or blocked domains for external sharing. An allowlist restricts sharing to approved partner domains (e.g., only @partner.com and @vendor.com). A blocklist blocks known risky domains. For highly regulated environments, EPC Group recommends allowlist mode — sharing is blocked to all external domains except explicitly approved ones.
Site-Level Sharing Overrides
While tenant-level controls set the ceiling, site-level overrides let you restrict individual sites below the tenant default. This is how you implement tiered sharing governance — different sites get different sharing capabilities based on their data classification.
Three-Tier Site Classification Model
Open Tier
Sensitivity Label: GeneralSharing: New and Existing Guests
Examples: Marketing materials, public documentation, partner collaboration portals
Restricted Tier
Sensitivity Label: ConfidentialSharing: Existing Guests Only
Examples: Project sites with pre-approved vendors, departmental collaboration, internal communications
Confidential Tier
Sensitivity Label: Highly ConfidentialSharing: Only People in Your Organization
Examples: HR records, financial data, legal documents, PHI/PII, regulated content
To configure site-level sharing: SharePoint Admin Center > Sites > Active sites > select the site > Policies tab > External sharing. The slider shows the site-level setting with the tenant maximum indicated. You can also configure site-level sharing via PowerShell using Set-SPOSite -Identity [SiteURL] -SharingCapability [Disabled|ExistingExternalUserSharingOnly|ExternalUserSharingOnly|ExternalUserAndGuestSharing].
EPC Group recommends automating site-level sharing configuration through sensitivity labels. When a site owner applies a sensitivity label (e.g., "Highly Confidential"), the label automatically sets the site sharing to "Only people in your organization" — no manual admin intervention required.
Guest Expiration and Lifecycle Management
Guest accounts are the most common source of stale external access in enterprise SharePoint. Without lifecycle management, former vendor employees, expired project collaborators, and one-time sharing recipients retain access indefinitely. A comprehensive guest lifecycle policy prevents this access sprawl.
SharePoint Guest Expiration
- SharePoint Admin Center > Sharing > Guest access expiration
- Set automatic expiration: 30 days (regulated), 90 days (standard)
- Guests receive email notification before expiration
- Site owners can re-invite if access is still needed
- Expired guests are removed from site permissions automatically
Entra ID Access Reviews
- Schedule quarterly reviews of all guest accounts
- Site owners or designated reviewers approve/deny continued access
- Auto-remove guests who are not approved within review period
- Track review completion rates for compliance audits
- Integrate with governance workflows for regulated industries
Sharing Link Expiration
- Anyone links: 7 days maximum (or disable entirely)
- Guest sharing links: 30-90 days based on classification
- Enforce expiration via tenant policy (users cannot override)
- Expired links return "Access denied" — no residual access
- Monitor link creation and expiration in unified audit log
Inactive Guest Cleanup
- PowerShell script to identify guests with no sign-in for 90+ days
- Automated notification to guest sponsors before removal
- Bulk removal of inactive guests via Entra ID
- Report on removed guests for compliance documentation
- EPC Group runs quarterly cleanup reducing stale guests by 40-60%
Anonymous Links (Anyone Links): Risks and Controls
Anyone links — also called anonymous links — create shareable URLs that grant access without authentication. They are the highest-risk sharing mechanism in SharePoint and the most common finding in EPC Group external sharing audits.
Why Anyone Links Are Dangerous
- No identity tracking: You cannot see who accessed the content — only that the link was used
- Uncontrolled forwarding: Recipients can forward the link to anyone; access spreads without your knowledge
- Search engine indexing: If an Anyone link is posted publicly, search engines may index the content
- No per-user revocation: You can only delete the link entirely; you cannot revoke one recipient's access
- Compliance violations: Anonymous sharing of PHI, PII, or financial data violates HIPAA, GDPR, and SOC 2
If You Must Allow Anyone Links
Some organizations have legitimate use cases for anonymous sharing (public marketing materials, press kits, event resources). If you must enable Anyone links, apply these controls:
Enable only on dedicated public content sites — never on team or department sites
Set maximum expiration to 7 days (shorter is better)
Restrict permissions to View only — never allow Edit via Anyone links
Deploy DLP policies to block Anyone links for content containing sensitive information types
Monitor Anyone link creation with automated alerts in Microsoft Defender for Cloud Apps
Require justification before Anyone link creation via a Power Automate approval workflow
Conditional Access Policies for Guest Users
Conditional access transforms SharePoint sharing from binary (allowed/blocked) to context-aware. A guest user's effective access depends on their authentication method, device, location, and risk level — not just their SharePoint permissions.
Require MFA for All Guests
CriticalEvery external user must complete multi-factor authentication before accessing any SharePoint content. This is the single most important conditional access policy for external sharing — it blocks 99.9% of credential-based attacks on guest accounts. Configure in Entra ID > Conditional Access > New policy > Target: Guest users > Grant: Require MFA.
Block Unmanaged Device Downloads
HighGuests on personal (unmanaged) devices can view content in the browser but cannot download, print, or sync files. This prevents sensitive documents from being saved to uncontrolled devices. App-enforced restrictions in SharePoint work with conditional access session controls to enforce this automatically.
Location-Based Access Restrictions
HighBlock guest access from countries where your organization has no business operations. For US-based enterprises, EPC Group typically blocks all non-US, non-EU access for guest users unless specific countries are required for vendor relationships. Named locations in Entra ID define the allowed geography.
Session Duration Limits
MediumLimit guest session duration to 1-4 hours. After the session expires, guests must re-authenticate. This reduces the window of exposure if a guest session is hijacked and ensures that access reviews reflect current authentication status. Persistent browser sessions should be disabled for guest accounts.
Risk-Based Access Blocking
MediumEntra ID Protection evaluates sign-in risk for guest users (impossible travel, anonymous IP, leaked credentials). Configure conditional access to block high-risk guest sign-ins and require MFA for medium-risk. This provides automated threat response without manual intervention.
Sensitivity Labels and External Sharing Integration
Microsoft Purview sensitivity labels are the most powerful enterprise tool for external sharing governance because they automate protection based on content classification. Labels follow the content — whether it is in SharePoint, downloaded to a device, emailed, or shared to Teams.
Label-Driven Sharing Automation
General / Public
Sharing: No sharing restrictions. Content can be shared with Anyone links if tenant allows.
Protection: No encryption. Standard audit logging.
Internal Only
Sharing: External sharing blocked at site level. Only internal users can access.
Protection: Optional encryption for downloaded files to prevent forwarding.
Confidential
Sharing: Sharing limited to authenticated guests from approved domains. No Anyone links.
Protection: Azure Information Protection encryption. View-only for external users.
Highly Confidential
Sharing: All external sharing blocked. Site-level override to internal only. DLP enforcement active.
Protection: Full encryption. No download, print, or copy. Watermarking enabled. Audit every access.
Auto-labeling policies extend this protection automatically. Configure Microsoft Purview auto-labeling to detect sensitive information types (Social Security numbers, credit card numbers, protected health information) and apply the appropriate sensitivity label without user action. This catches documents that users forget to classify and prevents accidental external sharing of regulated data.
EPC Group implements sensitivity label taxonomies as part of every SharePoint governance engagement. The label taxonomy is aligned with the organization's data classification policy and mapped to specific sharing, encryption, and DLP configurations.
DLP Policies for External Sharing Protection
Data Loss Prevention policies are the last line of defense against unauthorized external sharing. Even if sharing settings allow external access, DLP scans content and blocks sharing when sensitive data is detected.
DLP Policy Configuration for External Sharing
Define Sensitive Information Types
Select built-in types (SSN, credit card, passport numbers) and create custom types for organization-specific data (project codes, patient identifiers). Microsoft 365 includes 300+ built-in sensitive information types covering global regulations.
Set Detection Rules
Configure confidence levels and instance counts. Example: block external sharing when 5+ SSNs are detected with high confidence. Low instance counts with high confidence reduce false positives while catching bulk data exposure.
Configure Policy Actions
Actions escalate by severity: low confidence triggers a user notification (policy tip), medium confidence requires business justification to share, high confidence blocks sharing entirely and notifies the compliance team.
Enable Endpoint DLP
Extend DLP to downloaded files — if a user downloads a document from SharePoint and attempts to upload it to a personal cloud storage or email it externally, endpoint DLP blocks the action. This closes the download-and-reshare loophole.
Deploy in Test Mode First
Run DLP policies in test mode for 2-4 weeks to identify false positives. Review policy match reports, tune confidence levels and information types, then enable enforcement. EPC Group test deployments typically require 2-3 tuning iterations.
External Sharing Audit and Monitoring
Continuous monitoring is essential for external sharing governance. Without audit data, you cannot prove compliance, detect policy violations, or identify stale guest access. Enterprise-grade monitoring covers four layers: real-time alerts, periodic reports, access reviews, and compliance dashboards.
Unified Audit Log
Microsoft 365 Compliance Center > Audit > filter by sharing activities. Track every sharing invitation, link creation, guest access, and permission change. Retain audit data for 1 year (E3) or 10 years (E5 with advanced audit). Export to SIEM for long-term analysis.
SharePoint Sharing Reports
SharePoint Admin Center > Reports > view external users per site, sharing links created, and guest access frequency. Identify sites with unusually high external sharing activity and investigate whether sharing aligns with site classification and business need.
Automated Alerts
Microsoft Defender for Cloud Apps creates real-time alerts for high-risk sharing: Anyone link creation on restricted sites, bulk external sharing (50+ files in an hour), sharing to blocked domains, or sharing by compromised accounts. Alerts route to SOC or compliance team for investigation.
Quarterly Access Reviews
Entra ID access reviews prompt site owners to confirm or deny continued guest access. Track review completion rates, denied access removals, and expired guest cleanup. Access review results serve as compliance evidence for HIPAA, SOC 2, and ISO 27001 audits.
External Sharing Governance Framework
A comprehensive governance framework brings together all the technical controls into a documented, enforceable, and auditable policy. EPC Group governance frameworks for external sharing include six components that cover the full lifecycle from classification to audit.
Data Classification Policy
Define four classification tiers (Public, Internal, Confidential, Highly Confidential) mapped to sensitivity labels. Each tier specifies allowed sharing levels, guest access rules, and encryption requirements. The classification policy is approved by legal, compliance, and IT leadership.
Sharing Settings Matrix
Document the exact SharePoint sharing configuration for each site classification tier. Include tenant-level defaults, site-level overrides, link types, expiration settings, and domain restrictions. This matrix is the reference document for IT administrators and auditors.
Guest Lifecycle Procedures
Define the complete guest lifecycle: invitation approval workflow (who can invite guests), onboarding (terms of use acceptance), access duration (expiration policies), access reviews (quarterly re-approval), and offboarding (automatic removal of inactive guests).
Technical Control Deployment
Implement the sharing settings matrix in SharePoint Admin Center, deploy sensitivity labels in Microsoft Purview, configure conditional access policies in Entra ID, create DLP policies for sensitive content detection, and set up automated alerts in Defender for Cloud Apps.
Monitoring and Compliance Reporting
Establish monthly sharing reports, quarterly access reviews, annual governance assessments, and incident response procedures for sharing policy violations. Compliance reports document control effectiveness for auditors.
Training and Awareness
Site owner training on sharing responsibilities, end-user awareness for secure sharing practices, and executive briefings on external sharing risk posture. Training is repeated annually and updated when policies change.
Frequently Asked Questions
How do you manage external sharing in SharePoint?
External sharing in SharePoint is managed at three hierarchical levels: 1) Organization level — SharePoint Admin Center > Policies > Sharing sets the maximum sharing capability across all sites (options range from "No external sharing" to "Anyone with a link"), 2) Site level — each site can be configured with more restrictive sharing than the tenant default but never more permissive, 3) File/folder level — users share individual items within the boundaries set by their site and tenant policies. Best practices include setting the org-level default to "New and existing guests" (requires authentication), restricting sensitive sites to internal-only sharing, enabling guest expiration policies (30-90 days), requiring MFA for all guest users via Entra conditional access, and auditing external sharing activity monthly through the Microsoft 365 Compliance Center unified audit log.
What are the four SharePoint external sharing levels?
SharePoint provides four external sharing levels in order of permissiveness: 1) Anyone — creates anonymous access links that work without authentication; anyone with the link can access the content with no audit trail per user, 2) New and existing guests — external users must sign in with a Microsoft account, work account, or a one-time passcode; their identity is recorded in the audit log, 3) Existing guests only — sharing is limited to external users who already exist in your Entra ID directory (previously invited and accepted), 4) Only people in your organization — completely blocks external sharing. EPC Group recommends "New and existing guests" as the default org-level setting, with site-level overrides to "Only people in your organization" for sites containing confidential, regulated, or PII data.
How do you set up guest expiration policies in SharePoint?
Guest expiration policies automatically remove external user access after a defined period. Configure them in two places: 1) SharePoint Admin Center > Policies > Sharing > set "Guest access to a site or OneDrive will expire automatically after this many days" (recommended: 30-90 days depending on industry), 2) Entra ID > External Identities > External collaboration settings > configure access review schedules that prompt guest sponsors to re-approve or revoke access. Additionally, sharing links can have expiration dates set by default — in SharePoint Admin Center, set "Choose expiration and permissions options for Anyone links" to 7-30 days maximum. EPC Group implements a three-tier guest lifecycle: 30-day expiration for project-specific sharing, 90-day for ongoing vendor relationships, and quarterly Entra access reviews for long-term external partners.
Should I allow anonymous (Anyone) links in SharePoint?
EPC Group strongly recommends disabling Anyone links for most enterprises, especially those in regulated industries (HIPAA, SOC 2, GDPR, FedRAMP). Anyone links create anonymous access — you cannot track who accessed the content, cannot revoke access per user, and the links can be forwarded to unintended recipients without your knowledge. If your organization requires anonymous sharing for specific use cases (public marketing materials, press releases), create a dedicated SharePoint site with Anyone links enabled and internal-only sharing on all other sites. Set maximum expiration to 7 days and restrict to "View only" permissions. Never allow anonymous links with Edit permissions — this lets unknown users modify your content. The audit log records link creation but not individual anonymous access events.
How does conditional access work for SharePoint guest users?
Microsoft Entra Conditional Access policies add context-aware security layers for external users accessing SharePoint: 1) Require MFA for all guest users — the most critical policy; blocks guest access without multi-factor authentication, 2) Block access from unmanaged devices — guests on personal devices can only use browser-based view with no download, copy, or print, 3) Location-based restrictions — block guest access from countries where you have no business relationships, 4) Session controls — enforce limited session duration (1-4 hours) so guest sessions expire quickly, 5) Risk-based access — block access when Entra detects the guest sign-in is risky (leaked credentials, anonymous IP, atypical travel). Conditional access policies are applied at the Entra ID level and automatically enforced when guests access SharePoint. EPC Group baseline external access policies require MFA + managed device for all guest users.
How do sensitivity labels control external sharing in SharePoint?
Microsoft Purview sensitivity labels automate sharing restrictions based on content classification: 1) Site-level labels — applying a "Highly Confidential" label to a SharePoint site automatically sets its sharing to "Only people in your organization" and disables guest access without admin override, 2) Document-level labels — a "Confidential" label on a document applies Azure Information Protection encryption, meaning even if the file is shared externally, only authorized recipients can open it, 3) Auto-labeling policies — DLP rules detect sensitive content (SSNs, credit card numbers, health records) and automatically apply labels that restrict sharing, 4) Label priority inheritance — if a document has a more restrictive label than its containing site, the more restrictive setting applies. Sensitivity labels are the most effective enterprise external sharing control because they follow the content — not just the container.
How do you audit external sharing activity in SharePoint?
SharePoint external sharing audit uses multiple tools: 1) Microsoft 365 Compliance Center unified audit log — filter by "Sharing and access request activities" to see every sharing invitation sent, accepted, and revoked, 2) SharePoint Admin Center sharing reports — view external users per site, their last access date, and sharing link inventory, 3) PowerShell reporting — use PnP PowerShell (Get-PnPExternalUser, Get-PnPSharingLink) to export complete external sharing matrices across all sites, 4) Microsoft Entra access reviews — schedule quarterly reviews where site owners must approve or deny continued guest access, 5) Microsoft Defender for Cloud Apps — real-time alerts when external sharing exceeds thresholds or occurs on sensitive sites. EPC Group recommends monthly external sharing audits for regulated industries, with automated alerts for any Anyone link creation on non-approved sites.
How does DLP prevent unauthorized external sharing in SharePoint?
Microsoft Purview Data Loss Prevention (DLP) policies detect and block external sharing of sensitive content: 1) Content inspection — DLP scans documents for sensitive information types (SSNs, credit card numbers, health records, ITAR data) before sharing is allowed, 2) Policy actions — when sensitive content is detected, DLP can block the sharing entirely, allow sharing but require justification, notify the user and their manager, or restrict to view-only access, 3) Endpoint integration — DLP policies extend to downloaded files, preventing users from downloading SharePoint content and sharing it through unapproved channels, 4) Policy tips — real-time notifications warn users before they share content that violates DLP rules, allowing self-correction. DLP works alongside sensitivity labels and sharing settings — DLP detects content that should be restricted, sensitivity labels enforce the restriction, and sharing settings define the maximum sharing capability.
What is the difference between site-level and tenant-level sharing controls?
Tenant-level controls (SharePoint Admin Center > Policies > Sharing) set the maximum sharing permissiveness for the entire organization — no individual site can exceed this setting. Site-level controls (SharePoint Admin Center > Sites > select site > Sharing) can restrict sharing below the tenant level for specific sites. Example: if the tenant allows "New and existing guests," a specific site can be set to "Only people in your organization" but cannot be set to "Anyone." This hierarchy is critical for governance: set the tenant to a moderately permissive default (New and existing guests), then lock down individual sites containing sensitive data. EPC Group governance frameworks typically classify sites into three tiers: Open (matches tenant default), Restricted (existing guests only), and Confidential (internal only) — with sensitivity labels automatically enforcing the correct tier.
How do you build an external sharing governance framework?
A complete external sharing governance framework includes: 1) Classification policy — define which content types can be shared externally (public, internal, confidential, restricted) mapped to sensitivity labels, 2) Sharing settings matrix — document the sharing level per site classification tier with tenant defaults and site overrides, 3) Guest lifecycle management — guest invitation approval workflow, guest expiration policies (30-90 days), quarterly Entra access reviews, and automatic removal of inactive guests, 4) Technical controls — conditional access policies for guests (MFA, managed devices, location), DLP policies for sensitive content, sensitivity labels for automated protection, 5) Monitoring and audit — monthly sharing reports, automated alerts for policy violations, quarterly permission reviews, 6) Training — site owner training on sharing responsibilities, end-user awareness for secure sharing practices. EPC Group governance frameworks are documented in a SharePoint Governance Playbook that site owners reference for sharing decisions.
Related Resources
SharePoint Consulting Services
Enterprise SharePoint implementation, governance, external sharing audits, and security assessments from EPC Group.
Read moreSharePoint Permissions Best Practices
Complete guide to permission levels, groups, inheritance, and governance for enterprise SharePoint environments.
Read moreSharePoint Migration Services
Enterprise SharePoint migration with sharing policy migration and external access review during transition.
Read moreNeed an External Sharing Governance Assessment?
EPC Group conducts comprehensive external sharing audits for enterprises — identifying over-permissive sites, stale guest accounts, anonymous link exposure, DLP gaps, and compliance violations. Our assessment includes a prioritized remediation roadmap with sensitivity label taxonomy and conditional access policy recommendations. Most assessments complete in 2-4 weeks.