Clean up sharing links

SProbot's sharing links report with cleanup enables you to review and choose to remove unwanted sharing links. The list of sharing links per site is crawled on demand per site, and SProbot displays tenant-wide metrics for all such crawled sites in the health check.

Why should sharing links be reviewed?

It's easy for users to create sharing links by simply clicking the Share button, but they are very often unaware of the impact these links have on security.

Sharing links create security risks because:

• It's easy to accidentally share to someone who is not intended to be a recipient.
• When you click the share button, you don't immediately see who already has access, so it's easy to create yet another sharing link to the same person.
• With many sharing links in place on a single library, folder or file, it becomes difficult to get a clear picture of who has access to a specific file and who does not.
• Sharing links can be created at a very granular level on individual files, which means it's easy for a sensitive file deep in the folder structure of a library to be shared widely without anyone except the original sharer being aware of it.
• It's possible to create a sharing link which contains a mix of internal and external users, resulting in external access being somewhat obscured in the process.

We recommend that you periodically review sharing links at site level in consultation with site owners to ensure that they are appropriate.

How do you crawl a site for sharing links?

Sharing links are not automatically crawled for, as retrieving links is a highly processing-intensive action. Instead, retrieval can be done per site when needed.

To retrieve links the next time a site is crawled (which happens automatically in the background for all sites), check the "Refresh with next crawl" box within the site's Security tab.

To move a site into the priority queue for actioning as soon as the currently crawling site has completed, you can use the Crawl next button.

Note: Sharing links are only retrieved with the next crawl. Once this crawl is complete, the checkbox is automatically disabled until you check it again.

How do you use the sharing links report?

To select a site to view the report for, use Cleanup > Search or choose one of the sites with most sharing links using Reviews > Sites with sharing links

You can filter to specific sharing link types, with Anonymous links being most risky, and links involving External users being somewhat risky.

In the site you've selected to clean up, use the Security tab to view the report.

By default, the report will show all sharing links in the site, sorted by type.

You can see whether it's a folder or file, the name of the item, the scope (Internal, External & Internal, External, Anonymous), whether it's Edit or View access, who has access, when it was created, and who created it.

Filtering by scope enables you to narrow down the list by hiding relatively safe internal-only links:

When you have reviewed and found links which should not exist, you can select one or multiple links and delete them:

You'll need to confirm the deletion:

Deleting a sharing link does not delete the item or any other sharing links related to the item, only the individual link you select.

All sharing link deletion actions are recorded in the audit log and viewable in Reports > Activity history.