How to restrict external sharing in OneDrive and SharePoint

Somebody in the office shares a spreadsheet from OneDrive. They click Share, copy the link, paste it into an email and send it to the accountant. The accountant forwards it to a junior. The junior pastes it into a ticket on a supplier's helpdesk. Nobody has done anything strange, and the file is now readable by anyone who ever sees that ticket.

That is usually how a small business ends up searching for how to restrict external sharing in OneDrive and SharePoint. Not after an attack. After somebody asks, quite reasonably, who can actually open that link.

What an Anyone link actually is

Microsoft 365 has three kinds of sharing link, and the one that matters is called, plainly, Anyone. It opens the file for whoever holds it. No sign-in, no code, no record of who they are. Microsoft's admin documentation on sharing settings puts it about as straight as it gets: forwarded links work internally or externally, and you can't track who has access to shared items or who has accessed them.

The other two are safer. Only people in your organisation works for anyone signed into your tenant and nobody else. Specific people works only for the named recipients, who have to prove they are who the email was sent to, either by signing in or by typing a one-time code.

Out of the box, an Anyone link on a file lets the recipient edit it. On a folder, it lets them view, edit and upload. Nothing about the Share button tells your staff that.

Where your tenant probably stands

Every Microsoft 365 tenant has two master switches, one for SharePoint and one for OneDrive, in the SharePoint admin center under Policies, then Sharing. Each can be set to one of four levels: Anyone, New and existing guests, Existing guests, or Only people in your organisation. The OneDrive switch can be tighter than the SharePoint one but never looser.

Microsoft's current page on site sharing settings, updated in May 2026, lists the default for each kind of site. OneDrive is Anyone. So is the root communication site, the one at yourcompany.sharepoint.com. Sites connected to a Microsoft 365 group or a Team default to New and existing guests. Communication sites and classic sites default to Only people in your organisation.

Put those together and you get the usual picture in a tenant nobody has looked at. The shared company folders in Teams are reasonably locked down, because they need a guest account. Every member of staff's personal OneDrive is wide open, because it doesn't.

Microsoft's own guidance on unauthenticated sharing adds one more detail. When Anyone sharing is enabled, the default link type offered in the Share dialogue is normally Anyone as well. Staff don't choose to create open links. They just don't change the default.

The settings that matter

There are a dozen options on that page. Six of them do nearly all the work for a business of five to fifty people, and every one of them lives on the same admin page you already have if you use SharePoint and OneDrive.

The sharing level itself. For most firms the right answer for OneDrive is New and existing guests. Your staff can still send a file to anybody outside, but the recipient has to sign in or enter a code, and you can see who it was. If nobody in the business shares files externally at all, Only people in your organisation is a perfectly sensible answer.

The default link type. Set it to Specific people, or to Only people in your organisation if you share far more internally than externally. This one costs nothing and changes behaviour more than any policy document ever will, because staff take whatever the dialogue offers them.

An expiry on Anyone links. If you keep Anyone links, force them to expire. The setting takes a maximum number of days. Pick a number that matches how long a client really needs a file, which is usually closer to two weeks than two months. Microsoft is explicit that an expired link can't be renewed. The user makes a new one, which is the point.

View-only on Anyone links. You can restrict Anyone links on files and on folders, separately, so they only ever grant view. Anybody who needs to edit can be sent a Specific people link, which leaves a trail.

Limit sharing by domain. A list of up to 5,000 domains, used either to allow or to block. Most small businesses need about four on an allow list: the accountant, the solicitor, the payroll bureau and the biggest customer. Everything else is refused. It is the tightest control on the page and also the one that generates the most phone calls in the first week, so tell people before you switch it on.

Only certain people may share externally. You can allow only members of named security groups to share outside the company, and choose per group whether they can use Anyone links. In a twelve-person office, making that the two directors and the office manager solves most of the problem on its own.

There is also a setting that expires guest access to a site or a OneDrive after a set number of days, with the site owner able to renew it. For project work with outside contractors, it stops last year's subcontractor quietly keeping access to this year's drawings.

What breaks when you tighten it

Every one of those settings takes something away from somebody. Knowing what, before you click Save, is the difference between a quiet change and an afternoon on the phone.

Request Files goes first. It is the feature that lets a client drop documents into one of your folders without an account, and accountants and letting agents lean on it heavily. Microsoft's documentation says it requires OneDrive to be set to Anyone with edit permissions enabled for Anyone links, and that any other OneDrive setting disables it. If your team uses it, you have a choice to make, and it is a real one.

Guests lose access fast. Restrict or turn off external sharing and, in Microsoft's words, guests typically lose access within one hour. That is good when you mean it and bad when a client is halfway through downloading a contract.

Switching sharing back on is not a clean undo either. If you turn external sharing off for the organisation and later turn it on again, guests regain access and site links resume working. Microsoft's advice is to turn sharing off on the specific sites first if you don't want those guests back. Most people learn that one the hard way.

Teams is the last one. Files in a Team live on its SharePoint site, so a change at the organisation level can take away a guest's Files tab even though the Teams guest setting still says On. The fix is to set the organisation level to the most permissive thing you will genuinely allow, then tighten individual sites underneath it.

Finding what is already out there

Changing the settings deals with tomorrow. It doesn't tell you what went out last year.

On each SharePoint site, a site owner can open Site usage and run the Shared with external users report, which exports to a CSV file. Microsoft's support pages say you can't pick a time period for it, so expect to read the whole thing. Personal OneDrives have to be looked at one by one, which is where a business with forty staff starts to see why this is done once, properly, rather than a bit at a time.

The audit log is the other source, and it has a clock on it. Microsoft changed the default retention for Audit (Standard) from 90 days to 180 days for records created from 17 October 2023. Keeping them longer needs an E5 licence or an add-on, which almost no small business has. So if you want to know who opened a sensitive file through a link, the answer only goes back about six months. Before that it is gone.

Tighten the settings first and read the reports second. The other order means reading a list that is still growing.

Is a leaked link a data breach?

Sometimes. Article 4(12) of the UK GDPR defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. An open link to a list of customer addresses, forwarded somewhere it should not have gone, fits those words comfortably.

Whether it has to be reported depends on the risk to the people in the file, and a reportable breach has to reach the ICO within 72 hours of you becoming aware of it. We went through that assessment step by step in the piece on the 72-hour rule.

Two limits we state every time this comes up. We are not a law firm and we are not anybody's data protection officer. We help clients establish the facts, which is the part that needs somebody who can read an audit log, and we help them write it down. The decision and any report to the ICO are yours.

When the files belong to someone who has left

One more place links hide. When somebody leaves, their OneDrive is eventually deleted, and the links they created go with it, including the ones a customer is still relying on. We covered that end of it in the offboarding guide, and the backup side in whether Microsoft 365 backs up your data. The short version is that anything a customer depends on should live on a SharePoint site rather than in one person's OneDrive, and the settings above are far easier to reason about when it does.

What it costs with us

Our cloud and Microsoft 365 page lists external sharing controls under security and identity, next to MFA enforcement and conditional access, configured as part of a move rather than bolted on later. That is an honest description of when most of this work gets done.

If we are moving you into Microsoft 365, it is part of the migration at £77 per mailbox. If you are a managed client, reviewing and tightening sharing is part of looking after the tenant, which sits inside the managed plans at £50, £77 or £108 per user per month. If you are neither, it is hourly work: £126 an hour without an agreement, £86 on a plan, and £167 out of hours with a two-hour minimum. Ask for an estimate first. A small tenant is usually a morning, and a tenant with forty personal OneDrives full of old links is not. Ongoing UK GDPR support is a separate line on the same price list at £13 per user per month. Everything excludes VAT.

What we won't do is tell you a tenant is locked down because the settings page looks right. The settings stop new links. The old ones are still there until somebody reads the reports.

What to do this week

Open the SharePoint admin center, go to Policies and then Sharing, and write down what the two master switches say before you change anything. Set the default link type to Specific people. If Anyone is staying, put an expiry on it and make it view-only. Ask the team whether anybody uses Request Files, because that answer decides whether OneDrive can come down a level. Then run the external sharing report on your three most important sites and read it with a coffee.

It is rarely as bad as people fear. It is almost never as tidy as they assumed.