Summary

This guide helps you troubleshoot and resolve: How to stop external sharing of sensitive documents in microsoft 365. Follow the steps below to fix the issue.

Common Causes

How to stop external sharing of sensitive documents in Microsoft 365

External sharing allows your team to collaborate with clients, suppliers, and partners outside your organisation. However, if left unchecked, it can expose confidential internal documents to unintended recipients. This guide shows how to manage external sharing in Microsoft 365 across SharePoint and OneDrive so you can collaborate securely without risking data exposure.

Quick Fix Steps

1. Sign in to the SharePoint admin centre using an administrator account.
2. Navigate to Policies > Access control > Sharing.
3. Review the tenant-level external sharing options under SharePoint and OneDrive external sharing.
4. Set the appropriate default link type for SharePoint and OneDrive.
5. Select Save and allow up to 24 hours for settings to propagate.

Detailed Instructions

Understand Guest Access vs Anonymous Links

Microsoft 365 offers two primary ways to share content externally:

• Authenticated guest access: Recipients must verify their identity (usually via a one-time passcode or Microsoft account) before accessing the file. This is the safer option for sensitive documents.
• Anonymous sharing links: Anyone with the link can access the file without signing in. These links can be forwarded and should be avoided for confidential content.

Configure Tenant-Level Sharing Settings

1. Go to the SharePoint admin centre at https://admin.microsoft.com/sharepoint.
2. In the left navigation, select Policies, then choose Access control, then Sharing.
3. Under SharePoint and OneDrive external sharing, choose the level that suits your organisation:
   • Anyone: Allows anonymous links (least restrictive).
   • New and existing guests: Requires sign-in or verification (recommended for most small businesses).
   • Existing guests: Only allows sharing with people already in your directory.
   • Only people in your organisation: Disables all external sharing.
4. Select Save.

Changes at the tenant level set the baseline for all sites, but individual site and library settings can be more restrictive.

Set Default Link Types

1. Open the SharePoint admin centre.
2. In the left menu, select Policies > Access control > Sharing.
3. Select the policy applied to your organisation (typically Global).
4. Under File and folder links, choose the default link type:
   • Anyone links (not recommended for sensitive data).
   • People in your organisation.
   • Specific people (recommended for confidential documents).
5. Optionally, set link expiration and permissions (view or edit).
6. Select Save.

Manage Sharing at the Site Level

1. In the SharePoint admin centre, go to Active sites.
2. Select the site you want to manage.
3. In the site details panel, choose the Sharing tab.
4. Adjust external sharing for that specific site. You can make it more restrictive than the tenant setting, but not more permissive.
5. Select Save.

Manage Sharing for Individual Files and Folders

1. Open OneDrive or SharePoint in a web browser.
2. Select the file or folder you want to share.
3. Select Share.
4. Choose Specific people rather than Anyone or People in your organisation.
5. Enter the external recipient's email address.
6. Ensure Allow editing is cleared if they only need to view the document.
7. Select Send.

Avoid using Anyone links for sensitive contracts, financial records, or employee information. These links can be forwarded to unintended recipients and do not require authentication.

Audit External Access

1. In the Microsoft Purview compliance portal, go to Audit.
2. Search for sharing activities by user, file, or external recipient.
3. Review Sharing invitations and Anonymous link usage reports regularly.
4. Revoke access to any file shared in error by selecting the file in OneDrive or SharePoint, choosing Manage access, and removing the offending link or user.

Schedule a quarterly review of external sharing permissions to ensure former clients or suppliers no longer have access to your business documents.

Troubleshooting

External recipient cannot access a shared file

• Confirm the recipient is using the email address to which the invitation was sent.
• Check that the file is not restricted by a sensitivity label or conditional access policy.
• Ask the recipient to check their junk or spam folder for the sharing invitation.

Sharing options are greyed out

• Verify you have owner or member permissions for the site or library.
• Check whether a sensitivity label applied to the file restricts external sharing.
• Confirm the site is not locked to internal-only sharing at the site level.

Anonymous links are still working after being disabled

• Existing anonymous links may remain active until they expire or are manually revoked.
• Select the file in OneDrive or SharePoint, choose Manage access, and delete the specific anonymous link.

If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

Still Having Issues?