Microsoft 365 Collaboration Tools: Getting External Sharing Right

Teams, SharePoint and OneDrive are built for working together, including with an accountant, a client or a
subcontractor. External sharing makes that possible. It is also turned on by default for your whole SharePoint and
OneDrive environment
(Microsoft, external sharing overview).
Left as is, an employee can create a link anyone can open without signing in. Here are the settings that decide who
sees what, and what the Government of Canada asks of its own departments.

1. The organization’s sharing level

In the SharePoint admin center, under Policies, then Sharing, one slider sets both SharePoint and OneDrive. It has
four levels (Microsoft, manage sharing settings):

• Anyone: links that open without signing in;
• New and existing guests: the person signs in or enters a verification code sent by email;
• Existing guests: only guests already in your directory;
• Only people in your organization: no external sharing.

Two rules decide the rest. The most restrictive value always applies, and OneDrive can be as restrictive as
SharePoint or more, never more permissive (same source). Each site also has its own setting. Microsoft suggests
keeping confidential information in a site where external sharing is off, and creating separate sites for what gets
shared (Microsoft, overview).

2. The default link type

The File and folder links setting offers Specific people, the most restrictive, Only people in your organization, or Anyone with the link,
allowed only at the Anyone level, and for which you cannot tell who opened the file
(Microsoft, manage sharing settings).

A Microsoft page, now archived, advises making the default a link that only works inside the organization, to reduce
the risk of unauthenticated sharing by accident
(Microsoft, best practices, archived).
The Government of Canada asks its departments to make sharing links read only by default
(Security playbook for Microsoft 365, 2.3.4).

3. Link and access expiry

If Anyone links stay allowed, two settings frame them: Link expiration, the maximum number of days, and Link
permissions, to offer viewing only. Another setting removes a guest’s access to a site or a OneDrive after a chosen
number of days
(Microsoft, manage sharing settings).
Canada’s playbook says to set expiry periods for external sharing links
(2.2.4).
Microsoft recommends no specific number of days.

4. In Teams, a guest is not external access

Teams offers two different things. External access lets people from other organizations find your employees,
call them and chat with them. It is on by default, and those people have no access to your teams or files. Guest
access adds an outside person to a team. They get a guest account in your Microsoft Entra directory, and can then
share files and use the team’s resources
(Microsoft, guest access and external access).

By default, external access allows all domains, but it can be limited to a list of specific domains
(Microsoft, external meetings and chat).
Canada’s playbook says to disable guest access and external access unless the organization needs them
(2.3.2).

5. Guests who stay behind

A guest who leaves a team keeps their account in the directory. An administrator has to delete it
(Microsoft, guest access in Teams). Microsoft Entra
access reviews ask guests, or a manager, to confirm access at a set interval, then remove those who no longer need it.
They require a Microsoft Entra ID P2 or Microsoft Entra ID Governance licence
(Microsoft, access reviews).
Without that licence, the same review is done by hand, on the directory’s guest list.

6. Multifactor authentication, guests included

Canada’s playbook says to enforce multifactor authentication for all users through conditional access policies,
preferably a phishing resistant method
(2.1.2).
A guest is covered by the same protections, and conditional access and multifactor authentication can be required of
them (Microsoft, guest access in Teams). Our article
on Microsoft’s mandatory MFA explains what Microsoft already
requires, and what is left to do.

A reasonable starting point for an SMB

This is not a Microsoft rule, it is the sum of the recommendations above. New and existing guests for the
organization, rather than Anyone. A default link limited to specific people or to the organization. An expiry on any
link that stays open to everyone. A separate site for each shared client or project. And a guest review, written into
the calendar. The emergency admin account
completes this on the administrators’ side.

Frequently asked questions

How do you turn on external sharing in SharePoint and OneDrive?

In the SharePoint admin center, under Policies, then Sharing, you choose one of four levels for SharePoint and for OneDrive. Each site can be as restrictive as the organization or more, never less.

Can you share a SharePoint file with someone who has no Microsoft account?

Yes. At the New and existing guests level, the person enters a verification code sent by email. At the Anyone level, the link opens without signing in, but you cannot tell who opened it.

How do you delete a guest account in Teams?

Leaving the team does not delete the account. An administrator deletes it in the Microsoft Entra directory. Microsoft Entra access reviews, with a P2 or ID Governance licence, remove guests who no longer need access.

What now?

Not sure anymore who outside your company can reach your files? MPJM’s
free network analysis looks at Microsoft 365 accounts, who has access
to what, and former employees’ accounts still active. It is offered to businesses with 10 or more workstations. Our
Cloud and Microsoft 365 services cover the rest.

P.S. Sixteen questions, eight domains, a clear picture of your strengths and blind spots: start the assessment.