Secure File Sharing Guide: External Sharing, Links and Collaborators

Cloud file sharing lets any employee publish a sensitive file to the internet in two clicks, and most organisations have thousands of sharing links that nobody has reviewed since they were created. Anyone links work for whoever holds them, guests keep access long after a project ends, and attackers now use the same sharing features to deliver phishing that passes email filters. This guide covers external sharing settings in SharePoint and OneDrive, Google Drive, Dropbox and Box, choosing link types by data sensitivity, managing external collaborators, finding stale sharing links, information rights management and download, print and copy controls, and detecting file sharing service abuse. It is written for Microsoft 365 and Google Workspace administrators, data security teams and security operations.

Key takeaways

• Make the safe link the default. Default new links to Specific people or People in your organisation, so an Anyone link is a deliberate choice rather than the first option in the dialog.
• Anyone links need an expiry and view-only rights. Unauthenticated links cannot be attributed to a person and keep working when forwarded. Where they are allowed at all, cap their lifetime and remove edit rights.
• External collaborators are identities with an end date. Guest access should expire, require reauthentication and be reviewed by an owner, like any other third-party access.
• Rights management follows the file; sharing settings do not. Once a file is downloaded, link controls are gone. Encryption with usage rights, or browser-only access, is what limits download, print and copy.
• Your own sharing service is a phishing channel. Attackers share files from compromised vendor accounts, so the notification is genuine and the lure sits behind a trusted domain. Detect on sign-in risk and sharing patterns, not just email content.

How sharing links expose data

Every major platform offers the same four audiences, under different names. The risk rises with each step from named people to anyone holding the URL.

Microsoft's audit guidance is blunt about the first row: because an Anyone link can be copied, "it's reasonable to assume that any document that has an anonymous link is shared with a target user." Public file sharing in this sense is publication. Treat an Anyone link to a sensitive file as a potential disclosure, not a convenience.

Choosing a sharing model

Tie link types to data classification rather than to platform defaults. See the Data Classification Guide.

• Small organisations: turn Anyone links off, set the default link to organisation-only, allow external sharing only with existing or new guests, and set guest expiry. That alone removes most accidental exposure and needs no extra licences.
• Large organisations: keep a tenant baseline of guests only, then relax or tighten per site with sensitivity labels or site settings. Use dedicated external collaboration sites or shared drives, so external access is contained and easy to review.
• When to allow Anyone links: only for genuinely public material (marketing assets, published reports) or for file requests from many outsiders, and then on specific sites with a short expiry.
• Managed transfer instead of links: for one-off large or regulated transfers, a managed file transfer or secure data room with per-recipient authentication and audit is often a better fit than collaboration links.

SharePoint and OneDrive external sharing

SharePoint admin center > Policies > Sharing sets the tenant ceiling. Microsoft documents four levels: Anyone; New and existing guests; Existing guests ("Allow sharing only with guests who are already in your directory"); and Only people in your organization ("Turn off external sharing"). "The OneDrive setting can be more restrictive than the SharePoint setting, but not more permissive", and each site can be set lower than the tenant, never higher.

• Default link type: under File and folder links, choose Specific people or Only people in your organization. Microsoft's best-practice article notes the default is normally Anyone where Anyone sharing is enabled, which "raises the risk of accidental unauthenticated sharing".
• Anyone link expiration and permissions: "These links must expire within this many days" sets a maximum lifetime. Shortening it updates existing longer links; lengthening it does not extend them. By default Anyone links allow editing for files and edit, view and upload for folders: set files to View and folders to View or View and upload. Per site, Set-SPOSite with -OverrideTenantAnonymousLinkExpirationPolicy and -AnonymousLinkExpirationInDays overrides the tenant value.
• Who and where: limit external sharing by domain (allow or block list, up to 5,000 domains, also Set-SPOTenant -SharingDomainRestrictionMode) and allow only members of specific security groups to share externally.
• Guests resharing: by default guests need full control to share items externally; leave "Allow guests to share items they don't own" off.
• Guest expiry and reauthentication: set guest access to expire after a number of days, and require code-verified people to reauthenticate periodically.
• DLP for sensitive content: a Microsoft Purview DLP rule on SharePoint and OneDrive with the action "Restrict access or encrypt the content in Microsoft 365 locations" can block only people who were given access through Anyone links, so sensitive files cannot be exposed even where Anyone links exist. See the Data Loss Prevention (DLP) Guide.
• Unmanaged devices: Access control > Unmanaged devices offers Allow full access, Allow limited, web-only access, or Block access. Limited access gives "browser-only access with no ability to download, print, or sync files", enforced through Microsoft Entra Conditional Access, and can be set per site or by sensitivity label. See the Conditional Access Guide.

For tenant-wide Microsoft 365 hardening beyond sharing, see the Microsoft 365 Security Guide.

Google Drive, Dropbox and Box

• Google Drive: external sharing is set per organisational unit or group, and "Group settings override organizational unit settings". Options include warning users before they share externally, restricting sharing to allowlisted domains, blocking link sharing, and visitor sharing for people without Google accounts (anyone or trusted domains only). Turning external sharing off also removes external access to items already shared. To allow external sharing only for specific content, Google suggests an empty OU with sharing on, assigned to a shared drive. See the Google Workspace Security Guide.
• Dropbox: admins set who can be added to files and folders (Members only, or Members + approved people by email or domain, which does not apply to links), turn external links on or off (off also disables existing external links), and set the default audience (Anyone, Only people added, Members only) and default permission. "Set an expiration for new links shared outside your team" and "Require password for new links shared outside your team" need the default audience set to team or invited people.
• Box file sharing: shared links come in three levels: People with the link (no Box account needed), People in your company, and Invited people only. Admins set the maximum allowed actions (Can edit, Can view and download, Can view only) and defaults company-wide, and open links can carry a password, an expiry and download restrictions.

External collaborators

An external collaborator is a guest identity in your directory or a named external account with standing access to your content. Guests accumulate: projects end, people change jobs, and the access remains. Treat them as third-party identities. See the Third-Party Access Guide.

• Sponsor and owner: every guest has an internal sponsor, and every site or shared drive with guests has an owner who reviews them.
• Expiry by default: use the platform guest expiry, Google's per-person access expiration (a date within one year), and directory access reviews for guests in Microsoft Entra ID. See the Access Reviews Guide.
• Strong sign-in: require MFA for guests through Conditional Access or cross-tenant trust settings rather than relying on one-time codes for sensitive sites.
• Folder inheritance: Google warns that an Editor of a parent folder can share the folder and so grant access to a file even when "Editors can change permissions and share" is off on the file. Review access at folder and site level, not just per file.
• Leavers on both sides: remove your own leavers' external links during offboarding and ask partners to tell you when their staff leave.

Stale sharing links

A stale sharing link is one that still grants access after its business purpose has ended. Most live links in a mature tenant are stale, and Anyone links among them are the priority because nobody can tell who holds them.

1. Find them: in SharePoint, the data access governance Sharing links activity report shows the sites where users created the most Anyone, People in the organisation and Specific people links over the last 28 days; the Purview audit log holds the creation events for older history within your retention period. In Google Workspace use Drive log events and the external sharing reporting rule.
2. Expire by policy: set Anyone link expiry for the tenant and per site. In SharePoint a shorter tenant value also shortens existing longer links.
3. Remove in bulk: remove Anyone links on Confidential and Restricted content, then old Specific people links to guests whose sponsor has gone.
4. Ask the owner: use site access reviews so site owners confirm or remove remaining external access.

Information rights management and download, print and copy controls

Information rights management (IRM) encrypts the file and binds usage rights to identities, so protection travels with the file wherever it is copied. In Microsoft 365 this is sensitivity label encryption using the Azure Rights Management service: an admin can assign permissions in the label, or let users assign them, with options such as Do Not Forward ("Recipients can't forward the email, print it, or copy from it"), access expiry on a date or after a number of days, and offline access limits (Microsoft suggests 7 days for sensitive business data).

• External recipients: encrypted content shared with guests may need guest accounts and Conditional Access changes. Specifying a domain from another Entra organisation includes all of that organisation's verified domains.
• Enable label support in SharePoint and OneDrive before encrypting widely; without it search, eDiscovery, co-authoring and Office for the web do not work on encrypted files.
• Owners keep control: the person who applies the label has Full Control and can still open the file after expiry, so IRM protects against recipients, not insiders who own the content. See the Encryption Guide.

File sharing phishing and service abuse

File sharing services are now a standard delivery route for credential phishing: a URL-based attack in which every link points to a legitimate file sharing domain, so reputation filtering lets it through. Microsoft Threat Intelligence described the pattern in October 2024: attackers compromise a user at a trusted vendor, share a file from SharePoint, OneDrive or Dropbox with the target, and the recipient receives a genuine sharing notification ("This email is not a phishing email but a notification for the user about the sharing action"). Opening the file requires a one-time code, then a lure inside the file leads to an adversary-in-the-middle page that captures the password, MFA and session token, typically followed by business email compromise. Since mid-April 2024 the files have been restricted to the named recipient, time-limited and set to view-only, which blocks download and so evades sandbox detonation.

• ATT&CK: T1566.002 Spearphishing Link lists procedure examples using Google Drive, Dropbox and OneDrive links. The same services are used for theft: T1567.002 Exfiltration to Cloud Storage covers uploading stolen data to Dropbox, Google Drive, OneDrive and similar services, where traffic blends in.
• Detection: correlate sharing notifications from external tenants with risky sign-ins shortly after, and flag a file shared with many recipients (Microsoft's hunting queries use 20 or more) from a single external user. Watch for sign-ins from hosting providers and non-compliant devices after a file share is opened.
• Prevention: phishing-resistant MFA and token protection make the captured session less useful; risk-based Conditional Access and continuous access evaluation cut it short. See the AiTM Phishing Guide.
• Exfiltration control: restrict uploads to personal or unsanctioned file sharing services through the web proxy and tenant restrictions, so a sanctioned tenant cannot be swapped for a personal one. See the Data Exfiltration Guide.
• User guidance: teach staff that a real sharing notice from a known supplier can still carry a malicious file, and give them a quick way to report one.

How to implement

1. Baseline (weeks 1 to 2): export current tenant and site sharing settings, count active Anyone links and guests, and run the sharing links and Everyone except external users reports. Record the starting numbers for metrics.
2. Change defaults without breaking anything: set the default link type to Specific people or organisation-only, set Anyone links to view-only with an expiry, and turn on guest expiry. These mostly affect new links, although a shorter Anyone expiry also shortens existing longer links.
3. Pilot restrictions: lower external sharing to guests only on a pilot group of sites, apply DLP in test or simulation mode for Anyone links on sensitive content, and apply limited web-only access for unmanaged devices to a pilot site. Watch help desk tickets for two to four weeks.
4. Roll out by classification: enforce the DLP rule, apply sensitivity labels with site-level sharing settings, and create dedicated external collaboration sites for teams that need open sharing.
5. Clean up: remove stale Anyone links and lapsed guests, oldest and most sensitive first, and start owner reviews.
6. Rollback: keep the exported settings. Tenant and site sharing levels can be raised again immediately, but links removed during cleanup cannot be restored and must be reshared, so communicate cleanup dates in advance.

External sharing monitoring and measurement

In Google Workspace, use Drive log events with a reporting rule for external shares; in Dropbox, the shared link and shared folder membership events in the admin activity log. Send all of them to the SIEM and join them with sign-in risk.

Metrics:

• Active Anyone links, and the share of them on Confidential or Restricted content (target zero for the latter).
• Sharing links older than 90 days to external parties, trending down.
• Guests with no sign-in in 90 days, and guests without an expiry date.
• Percentage of sites at or below the baseline sharing level.
• DLP blocks of Anyone links on sensitive content, and overrides granted.
• Time from a reported malicious file share to blocking the sender and revoking affected sessions.

Common failure patterns

• Anyone as the default link: users pick the first option. Change the default before running any awareness campaign.
• Links that never expire: shared once for a deal or audit and still live years later. Public links of any kind leak in ways owners do not expect, as the JSONFormatter and CodeBeautify leak showed when saved share links exposed more than 80,000 pastes of secrets.
• Relying on view-only: view-only links still allow download unless download is blocked separately, and nothing in the link stops a screenshot.
• Guests without owners: no sponsor, no expiry and no review, so former contractors keep access to project sites.
• Tenant locked, sites open: a strict tenant setting with dozens of sites individually raised for one project and never lowered.
• Trusting a genuine notification: treating a real share from a supplier's tenant as safe, which is exactly what file sharing service abuse relies on.

Framework mapping

Practitioner checklist

• Set the default sharing link to Specific people or People in your organisation in every platform.
• Disable Anyone links, or limit them to named sites with view-only rights and an expiry of 30 days or less.
• Restrict external sharing to guests, approved domains and approved security groups; block guest resharing.
• Turn on guest expiry, MFA for guests and owner reviews of external collaborators.
• Block Anyone link access to sensitive content with DLP and apply browser-only access for unmanaged devices.
• Encrypt Restricted content with sensitivity labels and usage rights, with label support enabled in SharePoint and OneDrive.
• Remove stale Anyone links and lapsed guests on a schedule, most sensitive first.
• Stream sharing audit events to the SIEM and correlate inbound file shares with risky sign-ins.

Standards and references

• Microsoft Learn: Manage sharing settings for SharePoint and OneDrive
• Microsoft Learn: Manage access from unmanaged devices
• Microsoft Learn: Use sharing auditing in the audit log
• Microsoft Learn: Restrict access to content by using sensitivity labels to apply encryption
• Google Workspace Admin Help: Manage external sharing for your organisation
• Dropbox Help: Manage external sharing in your team
• Microsoft Threat Intelligence: File hosting services misused for identity phishing
• MITRE ATT&CK: T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Related NHI Mgmt Group resources: Microsoft 365 Security Guide · Google Workspace Security Guide · Collaboration Tool Security Guide · Data Loss Prevention (DLP) Guide · Third-Party Access Guide