SProbot highlights sites which have external sharing set to Anyone.
Why should this be reviewed?
External availability of a SharePoint site can be toggled between three settings:
- Only people in your organization
- Existing guests
- New and existing guests
- Anyone
This setting can only be changed by admins, not by site owners.
When the setting is Anyone, it allows completely anonymous access without requiring users to sign in or verify their identity. Anyone with the link can access content, making it impossible to track who is viewing or downloading your data.
You should limit the Anyone setting to sites which absolutely require it, in scenarios such as the publishing of reports to people who do not have Microsoft 365 accounts. Even in these scenarios, it's important to:
- Ensure that Anyone sites do not contain any sensitive content.
- Carefully define who will receive anonymous links, and limit sending of links to those users only.
- Ask recipients to not share links to a wider audience.
For all other sites, it's recommended that you do not allow Anyone sharing and instead rely on guest user access, enabling tracking of who interacted with content.
How do you see which sites allow sharing to anyone?
In Reports > Reviews, choose the Sites allowing sharing to anyone review.
Ensure that only sites which absolutely require it have sharing set to Anyone.
More guides
Use the Reviews tools to proactively identify and resolve issues which may affect storage and security on your tenant
Use the inactive workspaces review to identify sites and teams which are unused and could be archived or deleted.
Use the channel sites review to identify workspaces which have channel sites and involve additional complexity.
