Most businesses need to share files with clients, vendors and partners. The problem is not sharing itself, it is sharing that nobody can see or control. Getting your SharePoint external sharing settings right means people can still send a contract to a client in seconds, while you know who has access, for how long, and what they can do with it.
This guide walks through the settings that matter, the defaults I recommend for 20 to 500 person businesses, and how to handle the few sites that need to be different.
How SharePoint and OneDrive sharing levels work
External sharing is controlled at two levels: the organization and the individual site. The organization setting is the ceiling. A site can be set to the same level or more restrictive, never more open. OneDrive follows the same rule and cannot be more permissive than SharePoint.
There are four levels, from most to least open:
Level
What it allows
Risk
Anyone
Links that work for anyone who has them, with no sign-in
High: no record of who opened the file, and links get forwarded
New and existing guests
Sharing with external people who sign in or verify with a one-time code
Moderate: every access is tied to an identity and audited
Existing guests
Sharing only with guests already in your directory
Low: new external people must be added by an admin first
Only people in your organization
No external sharing
Lowest, but often unrealistic for client-facing teams
External sharing is turned on by default for new tenants. In the tenants I review, the organization level is usually still on Anyone, because nobody changed it after setup.
Recommended organization-level settings
Go to the SharePoint admin center and open Policies > Sharing. These are the settings I start with for most clients.
External sharing for SharePoint: set to New and existing guests. People can still share with anyone outside the company, but recipients must prove who they are.
External sharing for OneDrive: set to the same level or lower. Many businesses choose Existing guests for OneDrive so that client collaboration happens in team sites, not personal storage.
Default link type: set to Specific people. This is the most important change on the page. Users can still choose a broader link, but the safe option is what they get by default.
Default link permission: set to View. Users who need to grant edit access can change it when they share.
Guest access expiration: turn on Guest access to a site or OneDrive will expire automatically after this many days. 90 days is a sensible starting point. Site owners can extend access for guests who still need it.
Verification code reauthentication: require people using a verification code to reauthenticate after a set number of days, such as 30.
If you must keep Anyone links
Some businesses genuinely need anonymous links, for example to send marketing assets to large lists. If so, keep Anyone enabled but limit the damage:
Set Anyone links to expire within a fixed number of days, such as 14 or 30.
Restrict Anyone links to View for both files and folders.
Keep the default link type on Specific people, so Anyone is always a deliberate choice.
Turn Anyone off at the site level for every site that holds client or employee data.
Control which sites can share, and with whom
Set sharing per site
Not every site needs the same rules. In the SharePoint admin center, go to Sites > Active sites, select a site, open the Settings tab and choose More sharing settings. A practical pattern:
HR, finance and leadership sites: Only people in your organization.
Client project sites: New and existing guests, with guest expiration turned on.
Intranet and internal department sites: Only people in your organization or Existing guests.
Public marketing asset site: Anyone, with view-only, expiring links, if you need it at all.
Microsoft’s own guidance is to keep confidential information in sites with external sharing turned off and create separate sites for external collaboration. That one habit removes most oversharing risk.
Limit sharing by domain
If you only ever share with a handful of partner companies, use Limit external sharing by domain to allow only those domains. You can set this for the organization or per site under the advanced sharing settings. Remember that allowed and blocked domains in Microsoft Entra external collaboration settings also apply, so review both together.
Limit who can share externally
Under More external sharing settings, you can allow only members of specific security groups to share externally. This suits businesses where only account managers or partners should send files outside the company.
Use sensitivity labels to automate the rules
Site-by-site settings work, but they rely on someone remembering to set them. Microsoft Purview sensitivity labels can apply sharing rules automatically when a site is labelled. A “Confidential” container label can set the site to internal-only sharing, and labels can also set the default sharing link type for sites and documents.
Sensitivity labels for containers are available with Business Premium and E3 or higher. They are the cleanest way to keep sharing consistent as the number of sites grows.
Review what is already shared
Changing settings is only half the job. Files shared under the old rules may still be open, and existing links do not disappear just because the default changed. Plan a one-time cleanup, then a lighter review each quarter. A few ways to find what is already out there:
Search the Purview audit log for AnonymousLinkCreated, SharingInvitationCreated and AddedToSecureLink events over the last 90 days.
Ask site owners to review the guests listed on their sites and remove anyone who no longer needs access.
Review the guest list in the Microsoft 365 admin center under Users > Guest users and remove stale accounts.
Microsoft notes that when you restrict or turn off external sharing, guests typically lose access within about an hour. Warn site owners before you tighten a site that clients actively use.
What is the safest SharePoint external sharing setting that still allows client work?
For most businesses, New and existing guests at the organization level, a default link type of Specific people, view-only defaults, and guest access expiration. Sensitive sites should be set to internal only.
Should I turn off Anyone links completely?
If you can, yes. Anyone links do not require sign-in and cannot tell you who opened a file. If you need them, make them view-only, set an expiry, and disable them on sites that hold sensitive data.
Can a site be more open than the organization setting?
No. The organization-level setting is the maximum. Individual sites and OneDrive can only match it or be more restrictive.
Not sure how much of your data is shared outside the business? Book a free Microsoft 365 security assessment and we will review your sharing settings and show you what is exposed.
Most businesses need to share files with clients, vendors and partners. The problem is not sharing itself, it is sharing that nobody can see or control. Getting your SharePoint external sharing settings right means people can still send a contract to a client in seconds, while you know who has access, for how long, and what they can do with it.
This guide walks through the settings that matter, the defaults I recommend for 20 to 500 person businesses, and how to handle the few sites that need to be different.
How SharePoint and OneDrive sharing levels work
External sharing is controlled at two levels: the organization and the individual site. The organization setting is the ceiling. A site can be set to the same level or more restrictive, never more open. OneDrive follows the same rule and cannot be more permissive than SharePoint.
There are four levels, from most to least open:
External sharing is turned on by default for new tenants. In the tenants I review, the organization level is usually still on Anyone, because nobody changed it after setup.
Recommended organization-level settings
Go to the SharePoint admin center and open
Policies > Sharing. These are the settings I start with for most clients.If you must keep Anyone links
Some businesses genuinely need anonymous links, for example to send marketing assets to large lists. If so, keep Anyone enabled but limit the damage:
Control which sites can share, and with whom
Set sharing per site
Not every site needs the same rules. In the SharePoint admin center, go to
Sites > Active sites, select a site, open the Settings tab and choose More sharing settings. A practical pattern:Microsoft’s own guidance is to keep confidential information in sites with external sharing turned off and create separate sites for external collaboration. That one habit removes most oversharing risk.
Limit sharing by domain
If you only ever share with a handful of partner companies, use Limit external sharing by domain to allow only those domains. You can set this for the organization or per site under the advanced sharing settings. Remember that allowed and blocked domains in Microsoft Entra external collaboration settings also apply, so review both together.
Limit who can share externally
Under More external sharing settings, you can allow only members of specific security groups to share externally. This suits businesses where only account managers or partners should send files outside the company.
Use sensitivity labels to automate the rules
Site-by-site settings work, but they rely on someone remembering to set them. Microsoft Purview sensitivity labels can apply sharing rules automatically when a site is labelled. A “Confidential” container label can set the site to internal-only sharing, and labels can also set the default sharing link type for sites and documents.
Sensitivity labels for containers are available with Business Premium and E3 or higher. They are the cleanest way to keep sharing consistent as the number of sites grows.
Review what is already shared
Changing settings is only half the job. Files shared under the old rules may still be open, and existing links do not disappear just because the default changed. Plan a one-time cleanup, then a lighter review each quarter. A few ways to find what is already out there:
AnonymousLinkCreated,SharingInvitationCreatedandAddedToSecureLinkevents over the last 90 days.Users > Guest usersand remove stale accounts.Microsoft notes that when you restrict or turn off external sharing, guests typically lose access within about an hour. Warn site owners before you tighten a site that clients actively use.
The full list of options is documented in Manage sharing settings for SharePoint and OneDrive.
If you want sharing locked down without breaking client work, our sensitivity labels service automates site-level rules, and DLP policy configuration stops sensitive data leaving through shared links. Sharing settings are also reviewed in every Microsoft 365 security assessment.
Frequently asked questions
What is the safest SharePoint external sharing setting that still allows client work?
For most businesses, New and existing guests at the organization level, a default link type of Specific people, view-only defaults, and guest access expiration. Sensitive sites should be set to internal only.
Should I turn off Anyone links completely?
If you can, yes. Anyone links do not require sign-in and cannot tell you who opened a file. If you need them, make them view-only, set an expiry, and disable them on sites that hold sensitive data.
Can a site be more open than the organization setting?
No. The organization-level setting is the maximum. Individual sites and OneDrive can only match it or be more restrictive.
Not sure how much of your data is shared outside the business? Book a free Microsoft 365 security assessment and we will review your sharing settings and show you what is exposed.