SharePoint External Sharing Audit Checklist for Microsoft 365

What should a SharePoint external sharing audit include?

A SharePoint external sharing audit should include tenant-level sharing settings, site-level exceptions, guest users, anonymous or Anyone links, sensitive libraries, Microsoft Purview sharing events, owner approvals, remediation tickets, and recurring review dates. The goal is to prove that collaboration with vendors, clients, and partners is intentional—not an unmanaged data exposure path.

External sharing is useful. Finance teams exchange reports with auditors. Healthcare administrators coordinate with billing vendors. K-12 districts share project files with construction firms, legal counsel, and curriculum partners. Mid-market companies cannot run every workflow inside a sealed tenant.

The problem is that SharePoint and OneDrive sharing can sprawl quietly. A link created for a legitimate project can survive after the project ends. A guest can keep access after leaving a vendor. A team site can allow broader sharing than leadership believes. An “Anyone” link can make a sensitive file accessible to whoever receives the URL.

For Datapath clients, the right question is not, “Is external sharing enabled?” The right question is, “Can we show which external access exists, why it exists, who approved it, and when it will be removed?” That is an accountability question, not just a settings question.

Need help cleaning up Microsoft 365 sharing risk?

Datapath helps growing and regulated teams review SharePoint, OneDrive, Microsoft Entra, audit logs, guest access, and remediation ownership without disrupting legitimate collaboration.

Review Microsoft 365 identity services

Why does external sharing become risky in Microsoft 365?

External sharing becomes risky when permission decisions outlive the business reason for access. Microsoft 365 makes collaboration fast, but that speed can bypass vendor offboarding, legal review, data classification, and department-level ownership unless the organization runs recurring reviews.

Microsoft documents that SharePoint and OneDrive external sharing can happen at both the organization level and the site level, and that the more restrictive setting wins when the two do not match.¹ That architecture is powerful, but it also means an administrator must inspect more than one setting to understand the real exposure.

The highest-risk patterns usually look mundane:

• A project site allows external sharing because one vendor needed access during implementation.
• A department owner leaves, but the site continues accepting new external users.
• A shared OneDrive folder becomes a semi-permanent records repository.
• A guest account remains active after the vendor relationship ends.
• An anonymous link is copied into email, chat, a ticket, or a personal note.
• Sensitive finance, HR, student, patient, or client files sit in a library with no owner review.

CISA’s Microsoft 365 Secure Cloud Business Applications baseline for SharePoint and OneDrive says external sharing should be limited to approved domains or users in approved security groups when external sharing is used.² That is a practical standard for regulated and mid-market teams: collaboration should be allowed where there is a known business relationship, but not left open-ended by default.

What is the audit scope?

Scope the audit around business-critical sites, high-risk data, external identities, and sharing mechanisms—not just all SharePoint sites alphabetically. Start with the locations where exposure would create legal, operational, client, or compliance consequences.

A focused scope usually includes:

Scope area	What to inspect	Why it matters
Tenant sharing settings	SharePoint and OneDrive organization-level sharing rules	Establishes the outer boundary for collaboration
Site-level settings	Sites with less restrictive or special sharing permissions	Finds exceptions and department-level drift
Guest users	Microsoft Entra guest accounts, sponsors, last sign-in, group membership	Shows who outside the company can authenticate
Anonymous links	Anyone links, public links, file-request paths, expiration rules	Identifies access that may not map to a named user
Sensitive libraries	Finance, HR, legal, PHI, student data, public agency, or customer folders	Prioritizes cleanup by business impact
Audit events	Sharing invitations, secure links, anonymous link creation, guest additions	Creates evidence of who shared what and when
Remediation ownership	Ticket owner, approver, due date, exception reason	Prevents findings from becoming shelfware

For a first audit, do not boil the ocean. Pick the top 10 to 25 highest-impact SharePoint sites and OneDrive accounts: executives, finance, HR, legal, operations, public-facing collaboration, and any teams handling regulated data. Then expand the process once the evidence model works.

Which tenant and site settings should administrators review first?

Administrators should review organization-level sharing, OneDrive restrictions, site-level sharing, domain allow or block lists, default link type, link expiration, guest sharing permissions, and whether only approved security groups can share externally. These settings define how easily new exposure can be created.

Microsoft’s SharePoint external sharing documentation identifies several control points that matter for audit work: organization-level external sharing, site-level external sharing, OneDrive’s ability to be more restrictive than SharePoint, domain restrictions, guest expiration, and settings that affect whether guests can share items they do not own.³

Use this sequence:

1. Capture the tenant baseline. Record the current SharePoint and OneDrive external sharing levels, default link type, default link permission, expiration controls, and domain restrictions.
2. Export sites with sharing enabled. Identify sites where sharing is more permissive than expected or where external sharing is allowed for sensitive departments.
3. Check group-connected team sites. Microsoft 365 group and Teams membership can affect connected SharePoint access, so the audit must include group owners and guests.
4. Review OneDrive for executives and sensitive roles. OneDrive is frequently overlooked because it feels personal, but it can hold contracts, board materials, HR files, exported reports, and client workpapers.
5. Document exceptions. If a site legitimately needs broad external collaboration, record its business owner, approved domains, data boundary, review cadence, and expiration condition.

The audit output should show both policy and reality: what the tenant allows and what people have actually shared.

How do you find externally shared files and links?

Use Microsoft Purview Audit sharing events, SharePoint admin reports, Microsoft Entra guest-user data, and site-owner validation together. No single view tells the whole story because some access maps to named guests, some to links, and some to group or site membership.

Microsoft’s sharing-auditing guidance explains that sharing records can include events such as SharingInvitationCreated, SharingInvitationAccepted, AnonymousLinkCreated, AnonymousLinkUsed, SecureLinkCreated, and AddedToSecureLink.⁴ Those events help administrators identify resources shared with users outside the organization and connect the activity to the user who shared the resource.

A practical audit workflow looks like this:

1. Search Purview Audit for sharing and access request activities. Use a date range appropriate to the review period—often 30, 90, or 180 days.
2. Export all results, not only visible page results. The export should preserve the audit data needed for filtering and evidence.
3. Expand the AuditData field. Microsoft notes that the exported CSV stores details in the AuditData column, which can be parsed into properties for filtering.⁴
4. Filter for guest and external activity. Prioritize anonymous link creation, secure links to external users, sharing invitations, and guests added to secure links.
5. Map ObjectId values to business owners. A URL without an owner is not a resolved finding.
6. Confirm with site owners. Ask whether the access is still required, who approved it, and what date it should expire.

Do not treat a clean 30-day audit search as proof that nothing is externally shared. It may only prove there were no recent sharing events. Existing links and guests can predate the audit window, which is why the review also needs current permissions and guest-user inventory.

What should the remediation checklist include?

A remediation checklist should classify each finding, preserve legitimate collaboration, remove stale access, tighten defaults, document exceptions, and create a recurring review cycle. The worst cleanup strategy is to break vendor workflows first and ask questions later.

Use four remediation lanes:

1. Remove obvious stale exposure

Close access where there is no current business owner, no active vendor relationship, no current project, or no evidence of approval. Remove expired guests, delete Anyone links, revoke secure links, and document the change in a ticket.

2. Convert broad access to named access

Where collaboration is still needed, move from anonymous links to specific people links or authenticated guest access. For sensitive sites, restrict sharing to approved domains or approved security groups. That approach aligns better with CISA’s baseline language around limiting external sharing to known external domains or approved users.²

3. Apply tighter default settings

If the organization does not need Anyone links, disable them or set strict expiration and view-only defaults. If only certain departments should share externally, limit external sharing to trained security groups. If OneDrive sharing is broader than needed, make OneDrive more restrictive than SharePoint.

4. Record exceptions with owners

Some exceptions are legitimate. A legal matter, construction project, benefits renewal, school-services vendor, or healthcare billing workflow may need outside access. Keep those exceptions narrow: approved external domain, business owner, site owner, data classification, expiration date, and renewal requirement.

The deciding principle is simple: if nobody can defend the access, remove it. If somebody can defend it, make the scope and review date explicit.

How often should SharePoint external sharing be reviewed?

Most mid-market organizations should review high-risk SharePoint external sharing monthly or quarterly, then review the full tenant at least twice a year. The right frequency depends on data sensitivity, vendor volume, regulatory exposure, and how often project teams create new sites.

A workable cadence is:

• Weekly: Review high-risk alerts, new anonymous links, and external sharing on sensitive sites.
• Monthly: Review new guest users, stale guests, newly permissive sites, and unresolved remediation tickets.
• Quarterly: Ask site owners to certify access for finance, HR, legal, healthcare, student-data, client-data, and executive sites.
• Semiannually: Reassess tenant defaults, approved domains, link-expiration settings, OneDrive rules, and the external-sharing policy.
• After incidents or major vendor changes: Re-run the audit for affected sites, users, and domains.

For regulated organizations, the review should produce evidence leadership can read: number of externally shared sites, number of Anyone links removed, guest accounts disabled, exceptions approved, overdue findings, and business owners with pending certification.

What evidence should leadership and auditors see?

Leadership and auditors should see the current policy, the technical baseline, the audit export, the finding register, owner approvals, cleanup tickets, exceptions, and recurring-review metrics. Screenshots alone are weak evidence because they rarely show ownership, timing, scope, and remediation outcome.

A strong evidence packet includes:

• External sharing policy and data classification rules.
• Current tenant-level SharePoint and OneDrive sharing settings.
• List of externally shared sites and sensitive exceptions.
• Guest-user export with sponsor or business owner where available.
• Purview Audit export or report for the review period.
• Finding register with severity, owner, decision, due date, and close date.
• Sample before-and-after records for removed links or guests.
• Quarterly access certification results from site owners.
• Executive summary showing trends and unresolved risk.

This evidence matters because external sharing is rarely a purely technical issue. It is a business-risk decision about who can access company, client, patient, student, financial, or public-sector information. Datapath’s managed IT services and cybersecurity services are built around that accountability gap: discover the condition, assign ownership, fix what should be fixed, and keep proof that the control is still operating.

How does this connect to broader Microsoft 365 security?

SharePoint external sharing belongs inside a larger Microsoft 365 security program that covers identity, phishing defense, audit logging, backup, retention, and incident response. A perfect sharing report will not help much if attackers can compromise accounts, bypass MFA, or erase recovery options.

Use the external sharing audit as a bridge into related controls:

• Run a SharePoint permissions audit to catch internal over-permissioning.
• Review Microsoft 365 cloud logging so sharing and access events are retained and reviewable.
• Tighten Microsoft 365 phishing protection because stolen credentials can turn legitimate sharing into data theft.
• Confirm Microsoft 365 backup assumptions for SharePoint and OneDrive recovery.
• Connect access reviews to Microsoft 365 identity security services so guest access, conditional access, and privileged roles are governed together.

That is the Datapath standard: external collaboration should remain fast enough for the business, but controlled enough that leadership can explain and defend it.

FAQ: SharePoint external sharing audit checklist

What is the difference between SharePoint permissions and external sharing?

SharePoint permissions define who can access a site, library, folder, or file. External sharing is the part of that access model that allows people outside the organization to receive access through guest accounts, secure links, invitations, domain-allowed collaboration, or anonymous links.

Are Anyone links always unsafe?

Anyone links are not automatically malicious, but they are high risk for sensitive business data because access is not tied to a named authenticated user. If they are allowed, use strict expiration, view-only defaults, sensitive-site restrictions, and recurring audit review.

Can Microsoft Purview show who shared a SharePoint file externally?

Yes, Microsoft Purview Audit can record SharePoint and OneDrive sharing events, including events tied to external invitations, anonymous links, secure links, and guests added to secure links. Administrators still need to export, parse, filter, and map those events to business owners.

Should OneDrive be included in the external sharing audit?

Yes. OneDrive can contain executive, finance, HR, legal, customer, and project files. Microsoft notes that OneDrive settings can be more restrictive than SharePoint settings, so administrators should review OneDrive explicitly instead of assuming SharePoint site settings cover it.

Who should own SharePoint external sharing cleanup?

IT should run the technical discovery, but business owners should approve whether access is still needed. Security, compliance, legal, and vendor-management owners should be involved when findings touch sensitive data, regulated records, contracts, or third-party relationships.

Sources

• Microsoft Learn — Overview of external sharing in SharePoint and OneDrive in Microsoft 365¹
• CISA — Microsoft SharePoint & OneDrive Secure Cloud Business Applications baseline²
• Microsoft Learn — Manage sharing settings for SharePoint and OneDrive in Microsoft 365³
• Microsoft Learn — Use sharing auditing in the audit log⁴

Footnotes

1. Microsoft, “Overview of external sharing in SharePoint and OneDrive in Microsoft 365,” https://learn.microsoft.com/en-us/sharepoint/external-sharing-overview ↩ ↩²

2. Cybersecurity and Infrastructure Security Agency, “Microsoft SharePoint & OneDrive,” https://www.cisa.gov/resources-tools/services/m365-sharepoint-onedrive ↩ ↩² ↩³

3. Microsoft, “Manage sharing settings for SharePoint and OneDrive in Microsoft 365,” https://learn.microsoft.com/en-us/sharepoint/turn-external-sharing-on-or-off ↩ ↩²

4. Microsoft, “Use sharing auditing in the audit log,” https://learn.microsoft.com/en-us/purview/audit-log-sharing ↩ ↩² ↩³