Join our Newsletter — 33% off our NHI Course

How do you restrict external sharing in SharePoint Online and OneDrive?

You restrict external sharing in SharePoint Online and OneDrive by tightening tenant-level sharing settings and then applying stricter controls to sites or libraries that handle sensitive data. Limit sharing to approved users or domains, review existing guest links, and monitor for oversharing. Check default link behaviour and permissions inheritance so broad access does not reappear later.

How tenant-level controls shape external sharing in SharePoint Online and OneDrive

The first control point is the Microsoft 365 tenant, because site owners and users can only share within the guardrails the tenant allows. Set the default to the least permissive option that still supports business collaboration, then treat SharePoint and OneDrive as separate enforcement layers rather than as one shared setting. That keeps broad sharing from being the path of least resistance.

For this kind of rollout, the best practice is to pair the tenant baseline with a Microsoft 365 Security Guide approach so you can align external sharing with audit, sign-in, and governance settings in the same admin model. If you only change sharing defaults but leave the rest of the collaboration stack loose, users can often recreate exposure through links, guests, or inherited permissions.

One practical detail is link behaviour. “Anyone” links, anonymous access, and long-lived sharing links create very different exposure than named guest access, so the safest configuration is usually to narrow the default link type and require explicit approval for broader sharing. If a team truly needs public-style sharing, make that the exception rather than the tenant norm.

How to scope stricter sharing to sensitive sites and libraries

Tenant settings are necessary but not sufficient, because sensitive content usually needs tighter rules than the organisation’s general collaboration baseline. Apply stricter sharing to the sites, libraries, or folders that hold regulated, confidential, or business-critical data. That way, one permissive team site does not become the template for everything else.

This is where inheritance matters. Permissions and sharing settings that flow from parent sites can quietly reintroduce access if they are not reviewed after a project launches or an owner changes. Break inheritance only where needed, but also verify that the resulting access model is still understandable to site owners and support teams.

For operational hygiene, review the Secure File Sharing Guide when you are defining when to allow external collaborators, how to handle stale links, and how to decide whether a link should expire. It is especially useful when a site has multiple sharing patterns, because the control objective is not “no sharing”, it is “sharing that stays bounded to the intended audience.”

Where collaboration must extend outside the organisation, prefer named external users or approved domains over open-ended link sharing. That gives you a reviewable population and a clearer offboarding path when a project ends.

What to monitor after you tighten external sharing

Tightening the policy is only the start. Existing guest links, active external users, and old folders with inherited access can keep circulating data long after the new policy is in place. Recheck the sharing inventory after the change so old exposure does not survive in dormant links or forgotten team areas.

Monitor for oversharing patterns such as sudden spikes in guest invites, broad link creation, or files shared from sites that should be restricted. If those signals appear, the issue is often not the one file, but the combination of permissions inheritance, user convenience, and weak ownership of the content library.

For a broader Microsoft 365 hardening view, the Microsoft 365 Security Guide is also useful for connecting external sharing reviews to audit logs and change tracking. That matters because when sharing settings drift, you want evidence of who changed what, when, and whether the exposure was deliberate or accidental.

Risk and Threat Considerations

External sharing becomes risky when convenience controls outlive the business need that justified them. The main exposure is not only accidental oversharing, but also stale guest access, broad anonymous links, and inherited permissions that continue to expose content after a project, contractor relationship, or team reorganisation ends.

Failure mechanism: Users create permissive links or guest access once, then the organisation fails to review them after ownership changes, so the same content remains reachable through old URLs or inherited access paths.

Impact: Sensitive files can be accessed by unintended external parties, and the organisation may lose track of which documents are still exposed, which complicates incident response and cleanup.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework Control / Reference Relevance
NIST SP 800-53 Rev 5 AC-3 — Access Enforcement Controls who can access shared files and guest links.
AC-6 — Least Privilege Supports limiting sharing and permissions to the minimum needed.
AU-6 — Audit Record Review, Analysis, and Reporting Needed to spot oversharing, guest-link creation, and permission drift.
Recommendation — Enforce access decisions so external sharing stays limited to approved users and groups. Apply least privilege to sharing roles, guest access, and library permissions. Review sharing and audit logs to detect excessive external access.
ISO/IEC 27001:2022 A.5.15 — Access control Directly governs restricting access and sharing permissions.
A.5.18 — Access rights Covers provisioning, review, and removal of external access rights.
A.8.3 — Information access restriction Addresses restricting access to information and shared content.
Recommendation — Define and enforce access rules for external collaboration paths. Review and remove unused external access rights on a regular cycle. Restrict sharing of sensitive content to approved recipients and domains.
CIS Controls v8 CIS-5 — Account Management External sharing depends on controlling guest and collaborator accounts.
CIS-6 — Access Control Management Directly supports restrictive sharing settings and permissions oversight.
CIS-8 — Audit Log Management Needed to monitor oversharing and investigate sharing changes.
Recommendation — Manage guest and external accounts with clear approval and removal rules. Harden sharing defaults and review permissions inheritance across sites. Log and review sharing events, link creation, and permission changes.

Practitioner Guidance

What to verify: Confirm the tenant default, site-level overrides, and library inheritance all point in the same direction. A secure tenant setting does not help if a high-risk site still allows broader link types or unresolved guest access.

Decision rule: If the content is sensitive enough that an external viewer should be individually accountable, do not use anonymous sharing links. Require named external users, reviewable access, and a defined expiry or removal process.

Common mistake: Treating “external sharing disabled” as a one-time checkbox. In practice, oversharing often returns through exceptions, legacy links, and inherited permissions unless someone owns the review cycle.

Practitioner takeaway: The effective control is not simply blocking sharing, it is making every allowed external access path intentional, reviewable, and easy to retire when the business need ends.