Review external sharing

SProbot highlights sites which have external sharing set to Anyone.

Why should this be reviewed?

External availability of a SharePoint site can be toggled between three settings:

• Only people in your organization
• Existing guests
• New and existing guests
• Anyone

This setting can only be changed by admins, not by site owners.

When the setting is Anyone, it allows completely anonymous access without requiring users to sign in or verify their identity. Anyone with the link can access content, making it impossible to track who is viewing or downloading your data.

You should limit the Anyone setting to sites which absolutely require it, in scenarios such as the publishing of reports to people who do not have Microsoft 365 accounts. Even in these scenarios, it's important to:

• Ensure that Anyone sites do not contain any sensitive content.
• Carefully define who will receive anonymous links, and limit sending of links to those users only.
• Ask recipients to not share links to a wider audience.

For all other sites, it's recommended that you do not allow Anyone sharing and instead rely on guest user access, enabling tracking of who interacted with content.

How do you see which sites allow sharing to anyone?

In Reports > Reviews, choose the Sites allowing sharing to anyone review.

Ensure that only sites which absolutely require it have sharing set to Anyone.

‍