SharePoint, OneDrive, and Teams external sharing review
A SharePoint, OneDrive, and Teams sharing review is an audit of the settings that control how files, sites, and conversations are shared inside your organization and with people outside it. It checks external sharing levels, sharing links, guest access, and Teams external access against Microsoft’s public guidance, as one part of the Microsoft 365 tenant audit.
Microsoft’s guidance on sharing and guest access
Microsoft’s public documentation sets out guidance on external sharing, sharing links, guest access, Teams external access and team creation. The review checks your tenant against each item below that your licensing and the agreed scope include, quoted from the Microsoft Learn page cited with it.
Make organization-wide sharing settings the minimum security level, then tighten sites
What the review checks: The external sharing level set for SharePoint and for OneDrive at the organization level, then each active site’s own setting compared against it, since a site can only match the organization or be more restrictive.
“It's recommended that your organization-wide settings are the minimum security levels. Increase security on some sites, as needed.”
Secure external access to Microsoft Teams, SharePoint, and OneDrive with Microsoft Entra ID, Microsoft Learn Store confidential information in sites with external sharing turned off
What the review checks: Sites the business identifies as holding confidential content, such as HR, finance, or legal, are checked for an external sharing setting of Only people in your organization. Confidential sites still open to Anyone or to guests are flagged.
“If you have confidential information that you shouldn't share externally, store it in a site that has external sharing turned off.”
Overview of external sharing in SharePoint and OneDrive in Microsoft 365, Microsoft Learn Avoid enabling Anyone links, and if they are enabled, make them expire and allow view only
What the review checks: Whether SharePoint or OneDrive allows Anyone links and, if so, the link expiration and View only permission settings, which security groups may share externally and with whom, and which sites are set to Anyone.
“Enabling Anyone links isn't recommended. If you enable it, set an expiration, and restrict users to view permissions.”
Secure external access to Microsoft Teams, SharePoint, and OneDrive with Microsoft Entra ID, Microsoft Learn Set a more restrictive default sharing link while letting people choose other links
What the review checks: The organization’s default link type and permission, sites that override them, whether sensitivity labels set default link types, and whether links for people in your organization have an expiration policy.
“Set the default type of link to something more restrictive, while still allowing users to select other types of links as needed.”
Change the default sharing link type for a site, Microsoft Learn Turn off the setting that lets guests share items they don’t own
What the review checks: Whether Allow guests to share items they don’t own is selected, with the guest access expiration period recorded from the same settings panel.
“Allow guests to share items they don't own - Not recommended. The guidance is to disable this feature.”
Secure external access to Microsoft Teams, SharePoint, and OneDrive with Microsoft Entra ID, Microsoft Learn Decide whether SharePoint and OneDrive domain restrictions belong in Microsoft Entra B2B
What the review checks: The allowed or blocked domain lists for SharePoint and OneDrive sharing, compared with the collaboration restrictions in Microsoft Entra external collaboration settings, with mismatched or contradictory lists flagged.
“Review any custom domain sharing restrictions in SharePoint and OneDrive and decide if they should be moved to the Microsoft Entra B2B Allow/Deny list.”
SharePoint and OneDrive integration with Microsoft Entra B2B, Microsoft Learn Limit guest invitations to administrators and users in the Guest Inviter role
What the review checks: The guest invite setting in Microsoft Entra external collaboration settings, which by default lets all users, including guests, invite others, and who holds the Guest Inviter and User Administrator roles.
“It's recommended that administrators and users, in the Guest Inviter role, can invite.”
Secure external access to Microsoft Teams, SharePoint, and OneDrive with Microsoft Entra ID, Microsoft Learn Ask group owners to confirm that guests with access to sensitive content still need it
What the review checks: Whether access reviews cover guests in Microsoft 365 Groups and Teams, how often they recur, who reviews, and what happens to denied guests or when reviewers don’t respond. Group and Teams guest access settings are also recorded.
“If a group gives guests access to business sensitive content, then it's the group owner's responsibility to confirm the guests still have a legitimate business need for access.”
What are access reviews?, Microsoft Learn Licensing: Microsoft’s pages differ: its guide to guest access reviews lists Microsoft Entra ID P2 or Microsoft Entra ID Governance, and its access reviews overview lists Microsoft Entra ID Governance or Microsoft Entra Suite, with some capabilities on P2.
Admins can disable Teams interaction with external users to protect against attacks
What the review checks: The Teams external access choice for external domains, where Allow all external domains is the documented default, the settings for unmanaged Teams accounts, custom external access policies and their assignments, and the blocked users list.
“To further protect against external attacks, tenant admins can disable interaction with external users through enterprise federation and Teams for Life (TFL) and Skype interoperability”
Security best practices for Microsoft Teams, Microsoft Learn Document requirements for team creation, naming, classification, and guest access
What the review checks: Any written requirement is compared with the tenant: who can create Microsoft 365 Groups, SharePoint site creation settings, group naming and expiration policies, and sensitivity labels for teams, groups and sites.
“Document your organization’s requirements for team creation, naming, classification, and guest access.”
Plan for governance in Teams, Microsoft Learn Licensing: Microsoft’s Teams governance guidance describes group expiration as a Microsoft Entra ID P1 or P2 feature, with licenses needed for the administrator who configures it and the members of the affected groups.
What the sharing review checks
The review records how sharing is configured across SharePoint, OneDrive, and Microsoft Teams, and where sites, policies or settings depart from your organization’s baseline. Only the collaboration services your organization uses are in scope.
Part of the audit's collaboration and sharing area.
- External sharing levels
- The organization-level sharing levels for SharePoint and OneDrive, and every site set differently. Microsoft documents that external sharing is turned on by default, and that OneDrive and the root communication site default to Anyone, so the review records where each level stands today.
- Sharing links
- The default link type and permission, whether Anyone links are allowed, when they expire and what they permit, and which sites override the organization’s link defaults.
- Guest sharing controls
- Whether guests can share items they don’t own, when guest access expires, and which security groups may share externally.
- Domain restrictions and Microsoft Entra B2B
- Allowed and blocked domain lists for SharePoint and OneDrive sharing, compared with the Microsoft Entra B2B collaboration restrictions. Microsoft states that SharePoint one-time passcode authentication retires for commercial tenants starting in October 2026, and that once the retirement reaches a tenant, external users need a matching Microsoft Entra B2B guest account to access previously shared Specific people links.
- Teams external access
- Which external domains your users can chat and meet with, whether unmanaged Teams accounts can contact your users, and how external access policies are assigned.
- Guest access
- Guest settings for Microsoft Teams and Microsoft 365 Groups, who can invite guests, and whether access reviews confirm that guests still need access.
- Group, team and site creation
- Who can create Microsoft 365 Groups, teams and SharePoint sites, and how naming, expiration, and sensitivity label settings compare with your written requirements.
- Oversharing reports
- Whether data access governance reports are available under your licensing, when they were last run, and whether site access reviews were started for flagged sites.
When teams ask for it
- Preparing for Microsoft 365 Copilot
- Microsoft’s guidance for a secure and governed Copilot foundation includes disabling or restricting company-wide sharing groups and Anyone links, so teams review sharing before a rollout. The Microsoft 365 Copilot readiness review looks at the wider configuration.
- External collaboration has grown
- Guests, contractors, and shared sites have been added project by project, and the sharing settings and guest list have not been reviewed as a whole.
- After a sharing mistake
- A file reached the wrong person or was shared more widely than intended, and the team wants to know which settings allowed it and what else they allow.
- Answering a customer or auditor question
- A security questionnaire or internal review asks how external sharing and guest access are controlled, and the answer needs configuration evidence.
- Before tightening sharing settings
- The team plans to restrict sharing and wants to understand the current settings first, so changes can be sequenced with the least disruption to collaboration.
What you receive
Each finding is reported with the configuration evidence behind it, its business context, and a recommended action. Findings are sequenced into a remediation roadmap, so your team knows what to change first.
Questions
Get a clear view of your tenant’s configuration.
Tell us about your environment and the questions you need answered. We’ll help define an appropriate assessment scope.
Discuss your audit