SharePoint and OneDrive Sharing Settings: Stop the “Anyone” Links
Microsoft 365 makes sharing files easy — sometimes too easy. An “Anyone with the link” link opens for whoever has the URL, with no sign-in and no record of who that was. Forwarded once, it can reach people you have never met, and it keeps working long after the project ends. The fix is not to ban sharing; it is to change the defaults so the easy choice is also the safe one.
The four kinds of sharing link
- Anyone with the link — no sign-in required. Convenient, untraceable, and forwardable.
- People in your organization — anyone signed in with a company account. Fine for internal documents.
- People with existing access — a link that grants nothing new, useful for pointing a colleague at a file they can already open.
- Specific people — only the named people can open it, and outsiders verify their email address. This should be the default for anything going outside the company.
The settings to change
In the SharePoint admin center under Policies and Sharing, an administrator can set the rules for the whole organization. OneDrive follows the same settings and cannot be more open than SharePoint.
- External sharing level. “New and existing guests” lets people share with outsiders who sign in or verify their email, without allowing anonymous links. Choose “Anyone” only if you have a real need for anonymous links, and then put limits on them.
- Default link type. Set it to “Specific people.” Users can still choose another type when they need it, but the default covers most cases safely.
- Default permission. View rather than Edit, so people have to decide deliberately to let someone else change a file.
- Expiration for anonymous links. If you allow Anyone links, require them to expire within a set number of days.
- Guest access expiration. Guests lose access automatically after a period unless someone renews it, which cleans up old project access on its own.
- Limit sharing by domain. If you work with a known set of partners, an allow list keeps files from being shared with anyone else.
Individual sites can be stricter than the organization. HR, finance, and leadership sites usually should not allow external sharing at all.
Teams uses the same settings
Files shared in Microsoft Teams are stored in SharePoint and OneDrive, so the same rules apply. Guests added to a team can see that team’s files, which is exactly why guest access expiration and periodic membership reviews matter.
Clean up what is already out there
Changing the defaults does not revoke links people have already made. Site owners can review who has access from each site’s sharing settings, users can check “Manage access” on their own files, and the Microsoft 365 audit log records sharing activity, including anonymous link creation, so an administrator can find and remove old Anyone links. Start with the sites that hold the most sensitive information.
Go further with labels and data loss prevention
Microsoft 365 Business Premium includes sensitivity labels and data loss prevention. A “Confidential” label can encrypt a document so it only opens for the right people, even after it is downloaded or emailed, and data loss prevention policies can warn or block when someone tries to share files containing things like Social Security or card numbers. These are some of the most useful features you may already be paying for.
Keep collaboration easy
Lock things down too tightly and people will email attachments or upload files to personal Dropbox and WeTransfer accounts, which is worse. The goal is controlled sharing, not no sharing — the shadow IT problem starts when the approved way is harder than the unapproved one. If you are still deciding where files should live, see SharePoint vs. Dropbox and our file server to SharePoint migration guide.
Get your sharing settings right
Equal Tech Solutions’ Microsoft 365 services set sharing defaults, clean up old links, and apply labels for businesses across Cleveland, Chattanooga, and the Southeast. Contact us for a review of who can see your files today.