In this blog post Why SharePoint and OneDrive External Sharing Is a Hidden Risk we will explain how everyday file sharing can leave sensitive business information exposed long after a project, contract or client relationship has ended.
The problem usually starts with a reasonable request. An employee needs to send a proposal to a client, give a contractor access to project files or share financial information with an adviser. They click Share, enter an email address and move on. Months later, nobody remembers that the access still exists.
External sharing is not automatically unsafe. In fact, it is one of Microsoft 365’s most useful features. The risk appears when sharing is treated as a one-time action rather than ongoing access that needs an owner, an expiry date and regular review.
How SharePoint and OneDrive external sharing works
SharePoint is Microsoft 365’s shared document platform. It stores the files behind many Teams workspaces, department sites and company intranets. OneDrive is designed primarily for an individual employee’s work files, although those files can also be shared with colleagues and external people.
When someone shares a file, folder or site, Microsoft 365 creates a link or grants access to an external identity. Depending on your settings, the recipient may need to sign in and verify who they are, or they may receive an “Anyone” link that works without a Microsoft 365 account.
The organisation-wide SharePoint settings define the maximum level of sharing allowed. Individual SharePoint sites and OneDrive accounts can then be made more restrictive. The difficulty is that most employees never see these background controls. They simply see a Share button.
Why the risk stays hidden
1. Sharing links are easy to create and easy to forget
A link created for a three-week project may continue working months later. The employee who created it might change roles or leave the business, while the external recipient may move to a competitor or forward the message to someone else.
This creates a growing collection of forgotten access paths. Each link may look harmless on its own, but hundreds or thousands of unmanaged links can become a serious data exposure risk.
Business outcome: Expiring time-limited links reduces the number of old access paths that could be misused without preventing employees from collaborating with clients and suppliers.
2. Anonymous links can travel beyond the intended recipient
An “Anyone” link can be useful when distributing low-risk information, such as a public brochure. It is a poor choice for contracts, payroll information, customer records, internal reports or intellectual property.
Because the recipient may not need to authenticate, the business can lose visibility over who actually opened the file. If the email is forwarded, the link may work for the next person too.
A safer default is usually a “Specific people” link. This requires the recipient to prove they are the intended person, often through their work account or a temporary code sent to their email address.
Business outcome: Changing the default link type reduces accidental exposure while still allowing approved external collaboration.
3. Guest access often outlives the business relationship
Microsoft Entra ID, which manages identities and sign-ins for Microsoft 365, can create a guest identity when an external person is invited. This gives the organisation better control and visibility than an anonymous link.
However, guest identities still need to be managed. A contractor who finished last year may remain a member of a Team, giving them access to the connected SharePoint site and its files.
Set guest access to expire automatically where practical. For longer relationships, use scheduled access reviews that ask the site or business owner to confirm whether each external person still needs access.
Business outcome: Regular guest reviews reduce long-term exposure and make audits easier because the business can show that external access is actively governed.
4. External files may be downloaded to unmanaged devices
Even when the correct person receives a file, the device they use matters. A supplier may open it on a shared home computer, download it to a personal laptop or synchronise an entire folder to a device with no company security controls.
Microsoft Intune, which manages and secures company devices, and Conditional Access, which checks whether a sign-in meets your security rules, can help. Depending on the situation, you can block downloads, provide browser-only access or require an approved device.
This issue is explored further in the hidden risk of unmanaged devices accessing Microsoft 365.
Business outcome: Limiting downloads from unmanaged devices helps prevent company data from being copied into environments where it cannot be monitored or removed.
5. Sensitive files are not always treated differently
A marketing image and a spreadsheet containing customer information should not have the same sharing rules. Yet many Microsoft 365 environments treat every document in roughly the same way.
Microsoft Purview sensitivity labels classify information in plain business terms such as Public, Internal and Confidential. Those labels can apply stronger rules to sensitive documents or SharePoint sites, including restrictions on external sharing and unmanaged device access.
Data loss prevention policies can add another safety net. These policies inspect content for information such as financial details, health records or identification numbers and can warn the employee or block external sharing.
Business outcome: Applying protection based on the information’s sensitivity concentrates stronger controls where a disclosure would cause the most financial, legal or reputational damage.
A common real-world scenario
Consider a 200-person professional services firm working with clients, subcontractors and external accountants. Employees have been using SharePoint and OneDrive for several years, and external sharing is enabled across most sites.
A review finds former contractors in project Teams, anonymous links to old client folders and several OneDrive accounts sharing files externally. There is no evidence of malicious activity, but the business cannot confidently explain who can access its information.
The solution is not to disable external sharing. That would push employees towards email attachments and unapproved consumer file-sharing services. Instead, the firm changes the default to Specific people, limits external sharing on sensitive sites, introduces link expiration and assigns business owners to review guests quarterly.
The result is safer collaboration without adding a complicated approval process to every document.
What your Microsoft 365 team should check
- Confirm the organisation-wide sharing level. Understand whether anonymous links are allowed and whether OneDrive is more open than your business expects.
- Review high-risk sites first. Start with finance, HR, legal, executive, customer and product development information.
- Set Specific people as the default link. Employees can still share externally, but the safer option appears first.
- Limit who can share externally. Microsoft 365 can allow only selected groups of employees to invite guests or create external links.
- Restrict external domains where appropriate. Allow approved partner domains or block consumer email services for sensitive projects.
- Apply guest and link expiration. Short projects should not create permanent access.
- Review sharing reports and audit logs. These show which resources were shared, who created access and which external users were involved.
- Protect sensitive data. Use sensitivity labels, data loss prevention and device controls based on business risk.
External sharing also needs to be assessed alongside your broader permission structure. A secure link does not help if it grants access to an entire folder containing information the recipient should never see. Our guide to SharePoint permission risks that lead to costly data oversharing explains that part of the problem in more detail.
This is also a compliance and privacy issue
For Australian organisations, accidental external sharing can become more than an IT problem. If personal information is disclosed without authorisation and serious harm is likely, the incident may trigger obligations under the Notifiable Data Breaches scheme.
Good sharing controls also support the intent of the Essential Eight, the Australian government’s baseline cybersecurity framework. External sharing governance is not a replacement for the Essential Eight, but it closes data access gaps that the framework alone does not cover.
This is why a Microsoft 365 review should look beyond whether email and Teams are working. As discussed in why Microsoft 365 security remains a blind spot for SMBs, operational does not always mean secure.
Make sharing safe without making it difficult
The goal is not to stop employees working with clients, contractors and suppliers. It is to make the secure option the easiest option, remove access when it is no longer needed and give the business clear visibility over where its information has gone.
CloudPro Inc is a Melbourne-based Microsoft Partner and Wiz Security Integrator with more than 20 years of enterprise IT experience. Our hands-on team helps organisations review Microsoft 365, SharePoint, OneDrive, Intune and security controls without turning a practical assessment into a giant consulting project.
If you are not sure how many external users or sharing links exist in your Microsoft 365 environment, we are happy to take a look and explain the risks in plain English — no strings attached.
Discover more from CPI Consulting
Subscribe to get the latest posts sent to your email.