Microsoft 365 External Sharing Audit and Restriction: How to Find What Is Shared Outside Your Tenant and Lock It Down

The SharePoint admin center's tenant sharing setting is the ceiling for all external sharing:

# Connect to SharePoint Online
Connect-SPOService -Url https://contoso-admin.sharepoint.com

# Check current tenant-level sharing settings
Get-SPOTenant | Select-Object SharingCapability, DefaultSharingLinkType, `
    DefaultLinkPermission, RequireAnonymousLinksExpireInDays, `
    ExternalUserExpirationRequired, ExternalUserExpireInDays

Sharing capability levels (from most to least permissive):

• ExternalUserAndGuestSharing (Anyone): anyone links allowed, new guest invitations allowed
• ExternalUserSharingOnly: anyone links blocked, new guest invitations allowed
• ExistingExternalUserSharingOnly: no new guests, existing guests can still access
• Disabled: no external sharing at all

For most organizations, the recommended minimum is ExternalUserSharingOnly (guests require an account to access), with anyone links disabled or strictly expiring:

# Set tenant to block anonymous anyone links, require guest sign-in
Set-SPOTenant -SharingCapability ExternalUserSharingOnly

# Or keep anyone links but enforce 14-day expiration
Set-SPOTenant -RequireAnonymousLinksExpireInDays 14

# Set default link type to specific people (instead of anyone)
Set-SPOTenant -DefaultSharingLinkType Direct

Audit current external sharing activity across all sites:

# List all SharePoint sites with external sharing enabled
Get-SPOSite -Limit All | Where-Object {$_.SharingCapability -ne "Disabled"} |
    Select-Object Url, SharingCapability, StorageUsageCurrent |
    Sort-Object SharingCapability | Format-Table -AutoSize

# List all external users currently with access to any site
Get-SPOExternalUser -PageSize 50 -SiteUrl https://contoso.sharepoint.com/sites/project |
    Select-Object DisplayName, Email, AcceptedAs, WhenCreated, ExpirationTime

# Find all sites with guest users
Get-SPOSite -Limit All -IncludePersonalSite $false | ForEach-Object {
    $site = $_
    $externals = Get-SPOExternalUser -SiteUrl $site.Url -PageSize 10 -ErrorAction SilentlyContinue
    if ($externals) {
        [PSCustomObject]@{
            Site = $site.Url
            ExternalUserCount = $externals.Count
            OldestAccess = ($externals | Sort-Object WhenCreated | Select-Object -First 1).WhenCreated
        }
    }
} | Sort-Object ExternalUserCount -Descending

For anyone link discovery via the Unified Audit Log:

# Find anyone link creation events in the last 30 days
Connect-IPPSSession
$anyoneLinks = Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) `
    -Operations "AnonymousLinkCreated","AnonymousLinkUpdated" `
    -ResultSize 5000

$anyoneLinks | ForEach-Object {
    $data = $_.AuditData | ConvertFrom-Json
    [PSCustomObject]@{
        Time = $_.CreationDate
        User = $_.UserIds
        File = $data.SourceFileName
        Site = $data.SiteUrl
        Expiry = $data.ExpirationTime
    }
} | Export-Csv anyone-links-audit.csv -NoTypeInformation

Individual SharePoint sites can be more restrictive than the tenant level (but not more permissive). For sites containing sensitive data, restrict sharing to internal users only or to a specific external domain allowlist:

# Restrict a specific site to internal users only
Set-SPOSite -Identity https://contoso.sharepoint.com/sites/finance `
    -SharingCapability Disabled

# Restrict to specific domains only (for partner collaboration sites)
Set-SPOSite -Identity https://contoso.sharepoint.com/sites/partner-project `
    -SharingCapability ExternalUserSharingOnly `
    -SharingAllowedDomainList "partnercompany.com" `
    -SharingDomainRestrictionMode AllowList

# Audit all sites with domain restrictions currently configured
Get-SPOSite -Limit All | Where-Object {$_.SharingDomainRestrictionMode -ne "None"} |
    Select-Object Url, SharingCapability, SharingAllowedDomainList, SharingBlockedDomainList

For high-sensitivity site classes (HR, Legal, Finance, Board), apply a mandatory sharing restriction via sensitivity labels:

1. Create a sensitivity label in Microsoft Purview compliance portal: Labels > Create a label
2. Under 'Sites & Groups settings', set 'External sharing from SharePoint sites' to 'Only people in your organization'
3. Apply the label to the site: Get-SPOSite > Set-SPOSite -SensitivityLabel "{label-GUID}"

Sensitivity-label-enforced restrictions cannot be overridden by site owners, providing stronger governance than site-level settings that owners can change.

Guest user accounts in Entra ID persist indefinitely unless explicitly managed. Implement guest lifecycle controls:

# Find guest users who have not signed in for more than 90 days
Get-MgUser -Filter "userType eq 'Guest'" -All |
    Where-Object { $_.SignInActivity.LastSignInDateTime -lt (Get-Date).AddDays(-90) -or
                   $_.SignInActivity.LastSignInDateTime -eq $null } |
    Select-Object DisplayName, UserPrincipalName, CreatedDateTime, `
        @{N='LastSignIn';E={$_.SignInActivity.LastSignInDateTime}} |
    Sort-Object LastSignIn

For automated lifecycle management, configure Entra ID access reviews:

1. Entra ID admin center > Identity Governance > Access reviews > New access review
2. Review type: Teams + Groups (for M365 group and Teams guest access)
3. Scope: Guest users only
4. Reviewers: Group owners
5. Frequency: Quarterly
6. If reviewer does not respond: Remove access
7. Apply results automatically: Yes

This creates a quarterly review where each site/team owner confirms or removes each guest. Guests whose access is not confirmed are automatically removed after the review period.

Teams has two distinct external sharing mechanisms that administrators often conflate:

External access (federation): Allows Teams users to find, call, and message users in other Entra ID tenants and Skype consumer accounts. No shared channels, no file access. Configured at the Teams admin center org-wide level.

Guest access: Invites external users as guests into specific Teams, giving them access to channels, files, meetings, and apps in that Team. Configured both at Teams admin center org-wide level and per-Team by the team owner.

Audit current Teams guest access:

# Connect to Microsoft Teams PowerShell
Connect-MicrosoftTeams

# List all Teams with external/guest access enabled
Get-Team -NumberOfThreads 20 | Where-Object {$_.GuestSettings -eq 'True'} |
    Select-Object DisplayName, Description, Visibility, GuestSettings

# List all guest members across all Teams
Get-Team | ForEach-Object {
    Get-TeamUser -GroupId $_.GroupId | Where-Object {$_.Role -eq "Guest"} | ForEach-Object {
        [PSCustomObject]@{
            Team = $_.Team
            GuestEmail = $_.User
            Role = $_.Role
        }
    }
} | Export-Csv teams-guests.csv -NoTypeInformation

For Teams with no active collaboration (no messages in last 90 days), archive or delete the Team rather than allowing guests to retain access to potentially sensitive historical files.