External Sharing

External sharing is the set of controls that decide whether, and how, people outside your organization can access SharePoint and OneDrive content. It works at two levels that always combine to the most restrictive result: an organization-wide setting in the SharePoint admin center and a per-site setting an owner can tighten. Each level offers the same four options, from most to least open: Anyone with the link, New and existing guests, Existing guests only, and Only people in your organization. The capability also governs the kinds of links people can create, including Anyone links that need no sign-in, and adds guardrails such as link expiration and download limits. Anyone links can be forced to expire, guest access can be time-boxed, and recent updates let you expire even People in your organization links. External sharing is the out-of-the-box backbone of secure collaboration with partners, clients, and vendors.

Access Requests, Microsoft Entra Groups, Permission Levels, PowerShell, Share, SharePoint Advanced Management (SAM), Sharing Links Activity Reports

Client collaboration: share a library with an external project team
Vendor document exchange: send and receive files with suppliers
One-off file sharing: a single document to a partner without an account
Guest membership: add named external users to a site
Locked-down sites: HR or finance sites set to internal only
Time-boxed access: external links that expire at project end

Sharing Levels

Anyone: links work without sign-in, the most open option
New and existing guests: recipients verify with a one-time code
Existing guests only: only already-added guests can access
Only people in your organization: external sharing is off
Most restrictive wins: the org and site settings combine downward
Two-level model: the tenant sets the ceiling, sites can only tighten

Details

Feature Category: Sharing & Permissions

Link Types

Anyone links: no sign-in, ideal for low-sensitivity content
People in your organization: any internal user with the link
People with existing access: a stable link that adds no new permissions
Specific people: limited to named recipients, internal or guest
Default link control: owners and admins set the link type shown first
Edit or view: each link can grant editing or read-only rights

Guardrails

Anyone link expiration: force links to expire after a set number of days
Guest expiration: time-box guest access and require reconfirmation
Org link expiration: People in your organization links can now expire
Block download: allow view-only without saving local copies
Allowed domains: limit sharing to approved external organizations
Microsoft Entra B2B: guests are managed as Microsoft Entra accounts

Limits and Nuances

Tenant gates the site: a site cannot be more open than the organization
Default of thirty days: anonymous link expiry defaults to thirty days
Anyone is not the default: tenants increasingly start more restrictively
Reporting is separate: the Sharing Links Activity Report tracks usage
Guests still count: external users consume directory and license context
Minimums apply: organization link expiration has a seven-day minimum

Common Questions About External Sharing

What is external sharing in SharePoint?

External sharing is the capability that controls whether people outside your organization can access SharePoint and OneDrive content, and how. It spans an organization-wide setting and a per-site setting that combine to the most restrictive result. The options range from Anyone links that need no sign-in, through guest-based sharing, to fully internal only. It is how organizations collaborate with clients, vendors, and partners under control.

What are the four external sharing levels?

From most to least permissive: Anyone, where links work without signing in; New and existing guests, where recipients verify with a one-time passcode; Existing guests only, limited to people already in your directory; and Only people in your organization, which turns external sharing off. Both the organization and each site offer all four, and the more restrictive of the two always wins.

How do organization and site sharing settings interact?

External sharing has a setting at the organization level in the SharePoint admin center and a separate setting on each site. To share externally from any site, the organization level must allow it first, and individual sites can then be set the same or tighter. When the two differ, SharePoint always applies the most restrictive value, so a site can never be more open than the tenant.

Can external sharing links expire?

Yes. Anyone links can be required to expire after a maximum number of days, with a common default of thirty. Guest access can be time-boxed so external users must be reconfirmed periodically. More recently, even People in your organization links can be set to expire, with a minimum of seven days, either tenant-wide or per site. Expiration is a key guardrail for reducing stale access.

What is the difference between an Anyone link and a guest?

An Anyone link grants access to whoever holds the URL, with no sign-in and no identity, which is convenient but hard to track. A guest is a named external user added to your Microsoft Entra directory who signs in to access content, so their activity is attributable and can be governed. Guests support auditing and expiration in ways anonymous Anyone links cannot.

When should I review my external sharing setup?

External sharing is powerful but easy to leave too open, which is how sensitive files end up reachable by anyone with a link. Greg Zelfond, the consultant behind LookBook 365, sets a sensible tenant baseline, tightens individual sites to match their content, and pairs the settings with expiration and reporting so collaboration stays safe. For organizations unsure where their exposure sits, that governance review is exactly where he helps.