External sharing in SharePoint enables organizations to collaborate with partners, vendors, and clients by granting them access to files, folders, or entire sites. However, improper management of external sharing can lead to data leaks, compliance violations, and unauthorized access.
This guide covers how to manage external sharing in SharePoint securely by configuring settings, setting permissions, and following best practices.
1. Understanding External Sharing in SharePoint
🔹 External sharing allows users to share content with people outside the organization.
🔹 Sharing can be done at site, library, folder, or file level.
🔹 External users can be authenticated guests (Microsoft accounts) or anonymous users (via sharing links).
Types of External Sharing:
✔ Anyone Links (Anonymous Access) – No sign-in required; anyone with the link can access.
✔ People with Existing Access – Requires sign-in and existing permissions.
✔ Specific People – Restricted to selected users (guests or internal).
✔ Organization-wide Sharing – Users in a specific external organization can access content.
2. Configuring External Sharing Settings
Step 1: Access External Sharing Settings
✔ Sign in to the Microsoft 365 Admin Center.
✔ Navigate to SharePoint Admin Center > Policies > Sharing.
✔ Adjust external sharing settings at the tenant level or per site collection.
Step 2: Choose the Right External Sharing Level
SharePoint provides four external sharing levels:
| Sharing Level | Description | Best For |
|---|---|---|
| Anyone (No Sign-in Required) | Allows anonymous access via link | Low-risk files, public documents |
| New and Existing Guests | Requires guests to sign in with an email | Secure collaboration with external users |
| Existing Guests Only | Only pre-approved guests can access content | Restricted sharing with known users |
| Only Internal Users | No external sharing allowed | Highly sensitive data |
Best Practice: Set the default external sharing policy to New and Existing Guests to maintain security.
Step 3: Restrict External Sharing for Specific Sites
✔ Go to SharePoint Admin Center > Active Sites.
✔ Select the site you want to configure.
✔ Click Sharing and adjust external sharing settings per site.
Example: Set high-security sites (HR, Finance) to Only Internal Users while allowing collaboration sites to use New and Existing Guests.
3. Managing Guest User Access
Step 1: Control Guest Expiration Policies
✔ Set guest access expiration to prevent indefinite access.
✔ Go to Microsoft 365 Admin Center > Org Settings > Security & Privacy.
✔ Configure automatic guest access expiration (e.g., 30-90 days).
Step 2: Require Guest Verification
✔ Ensure guests authenticate via Microsoft or work accounts.
✔ Disable anonymous access for sensitive content.
✔ Enable Multi-Factor Authentication (MFA) for guest users.
Best Practice: Use Microsoft Entra ID (Azure AD) to manage external user authentication.
4. Managing Shared Links and Permissions
Step 1: Configure Link Expiration and Restrictions
✔ Set expiration dates for shared links to reduce risk.
✔ Restrict “Anyone” links to view-only access.
✔ Prevent external users from sharing files further.
How to Enable Link Expiration:
✔ Go to SharePoint Admin Center > Policies > Sharing.
✔ Set expiration for anonymous links (e.g., 7, 14, or 30 days).
Step 2: Monitor and Revoke Shared Links
✔ Regularly audit external sharing reports in Microsoft Purview Compliance Center.
✔ Revoke access when no longer needed.
✔ Use Microsoft Defender for Cloud Apps to track unusual activity.
Best Practice: Enable Data Loss Prevention (DLP) policies to prevent sensitive data from being shared externally.
5. Auditing and Monitoring External Sharing
Step 1: Enable External Sharing Reports
✔ Go to Microsoft Purview Compliance Center.
✔ Navigate to Audit > Search.
✔ Track external user access and sharing activities.
Step 2: Use Conditional Access for External Users
✔ Restrict external access based on location, device compliance, or risk level.
✔ Require MFA for guest users.
✔ Block access from untrusted locations.
Example: Allow external access only from trusted business partners’ domains.
6. Best Practices for Secure External Sharing
✔ Avoid “Anyone” links – Use “Specific People” sharing for better control.
✔ Require MFA for external users to enhance security.
✔ Set expiration dates for external guest access and shared links.
✔ Limit guest permissions to view/edit only necessary files.
✔ Enable audit logs to monitor external sharing activities.
✔ Regularly review external sharing settings and adjust as needed.
7. Conclusion
Managing external sharing in SharePoint requires a balance between collaboration and security. By configuring sharing settings properly, enforcing security policies, and monitoring access, organizations can ensure safe and controlled external collaboration.