Office 365 external sharing
A link shared in 2023 still works today. Who has it now?
A typical tenant carries thousands of sharing links, and "anyone with the link" links have no expiry unless someone set one - so a proposal shared in 2023 is still public today. 1Security lists every link in your Office 365 tenant with its scope, type, password and expiration, crosses them with what the files contain, and removes the ones nobody would defend.
The problem
A sharing link is a permission that never shows up in a log.
Every deadline produces links. A proposal shared with "anyone" to skip the guest invitation, an edit link mailed to a contractor, a review link pasted into a chat. Each one made sense on the day it was created - and each one is still valid, because a link does nothing until someone uses it and writes no log line just for existing.
The scale is what surprises people. In a typical tenant we count thousands of active sharing links, a large share of them anyone links, most with no password and no expiration. Some are on files that hold card numbers, IDs, contracts or health data. Nobody decided those files should be public forever; nobody decided they should not be either.
Opening a file shows you the links on that file. The question that actually matters is tenant-wide: which of my millions of files carry an anyone link with no expiration and sensitive content inside? 1Security answers it as one filter across the whole tenant.
In practice
From every link in the tenant to the short list that must go.
One filterable pass in 1Security - most teams find in minutes what manual audits missed for years.
- 01
List every link in the tenant
Open Files and filter by link scope: anyone, organization, specific people. Split by link type (view, edit, review), links without a password, links past their expiration, disabled links. The whole tenant is one list.
- 02
Run the public + sensitive + permanent filter
Shared with anyone, contains sensitive information, no expiration. That is your genuine already-exposed list. In a mid-size tenant it is usually tens to a few hundred files - small enough to fix this week, and impossible to assemble by hand.
- 03
Strip exactly the right grants
Select the files and choose Remove access. 1Security lists every user, group and link with a path to each file - direct grants, links, groups, inheritance - and you pick which ones to strip. The change is pushed to Microsoft 365 through the separately consented write module.
- 04
Keep it fixed
Enable the link automation and links that outlived their purpose are retired as staged proposals behind a 72-hour review window. An instant alert fires the moment a new anyone link lands on a sensitive file, with the file and the detections attached.
What makes it work
Three parts of the platform behind the audit.
Link hygiene in 1Security is a standing filter, not a quarterly project.
SharePoint governance
Link scope, type, password and expiration filters across the whole tenant - plus the sites whose sharing defaults keep producing risky links.
Explore the feature →Access management
Remove access resolves every path to a file - direct grants, links, groups, inheritance - so revoking a link never leaves a hidden door open.
Explore the feature →Alerts
The ongoing watch: an instant alert when a new public link appears on sensitive content, with the evidence attached.
Explore the feature →
FAQ
Common questions.
Will removing links break legitimate sharing?
You see every grant on a file before touching anything and choose exactly which ones to strip. Automated cleanup is staged behind a review window - 72 hours by default - and rejecting a proposal snoozes it instead of losing it. Every executed change is logged in Actions.
Can we see whether a link was ever used?
Yes. Up to three years of activity history ties access events to files, and the email trail on each file shows how many times it was uploaded or linked in mail and when it last left that way.
How is this different from checking sharing links site by site?
Checking site by site tells you which links exist on that site. 1Security lists links across the whole tenant, filters them by scope, password and expiration, and crosses them with sensitive-content detections - so the question "which public links point at sensitive files" has an answer.
What does 1Security need to run this?
Read-only consent and standard Microsoft 365 licenses - Business Basic upward, no E5. Write actions such as removing links ride a separate opt-in consent.
The 1Security platform
External Link Sharing is just the beginning
External Link Sharing is one screen of the 1Security platform for Microsoft 365. Locations, devices, apps, AI agents, logs, permissions, sensitive data, compliance, reports and actions run on the same read-only connection, on the licence you already have.
- AI agents and CopilotThe agent registry: owners, reach, who each agent acts as, what Copilot will see. The EU AI Act checks per agent, accountable owner, instruction transparency and impact assessment, measured from the tenant. Readiness before the licences, governance after.
- Activity logs and forensicsUp to three years of searchable activity on a standard licence. What was opened, downloaded, shared, by whom, from where, on which device.
- Anomalies and detectionsSpikes in sharing, downloads, sign-ins, consent and agent activity, scored against each tenant’s own pattern, with curated response actions.
- Sensitive dataPersonal data, credentials, financial and health records found by our own classifiers, with a Microsoft second opinion where the client has it.
- Sensitivity labelsLabel coverage and gaps across sites and files, so the protection the client paid for is actually applied.
- Files, sites and the column browserBrowse the tenant like a file system: site, library, folder, file, with the permissions and sensitivity of each level beside it. A problem solved in itself.
- Microsoft 365 Alerts ToolOne alert model across policies, activity and anomalies - with the evidence attached and the alert threshold in your hands.
- Microsoft 365 Monitoring ToolReal-time monitoring that catches a mass download while it is unfolding - across users, files, apps, AI agents and devices.
- Copilot Security ToolEvery AI agent's real blast radius - quantified before rollout, watched and constrained after.
- Shadow Device DetectionEvery device touching your data, reconstructed from real activity - including the machines that never enrolled anywhere.
- Impossible Travel DetectionLocations as identities, not IPs: country, city and network for every action, first-seen origins, travel timelines with verdicts - no E5, no P2.
- Conditional Access MonitoringDeclared Conditional Access compared against observed sign-ins: coverage verdicts, ungoverned traffic share, and the ranges your offices outgrew.
- Office 365 Access ManagementEffective access, resolved - who can reach what, through which grant, and one place to take it away.
- SharePoint Governance ToolEvery site ranked by exposure and abandonment - links, guests and Copilot access under control.
- Office 365 User ProvisioningLifecycle access from day one to offboarding - reach, dormant accounts and license reclaim in one flow.
- Microsoft 365 Audit ToolUp to three years of searchable activity history - every action tied to an actor, device and location.
- Microsoft 365 Inventory ToolEight live inventories on one permission graph - including the sites, devices and AI agents that were never registered anywhere.
- Office 365 ReportingAnswers, not exports - regulator-grade numbers, saved views and a read-only API for your SOC.
- Microsoft 365 File PermissionsWho has access to any file, and why - people, links, apps and AI agents on one map, with the fix in the same place.
- Sensitive Data DiscoveryWhere regulated data lives and everything that can reach it - two detection engines, no premium licence required.
- Office 365 Email MonitoringOutbound sensitive content, delegated-send abuse and whole-thread evidence that survives deletion.
- Purview Label CoverageWhat your sensitivity labels actually cover, and which of them protect anything at all.
- AI Agent InventoryEvery agent in the tenant with its real reach counted, its blueprint reviewed, and guardrails you can verify.
- AI Data RestrictionDeclare a data type off-limits to AI and every agent, app and user still reaching it becomes a live violation - recorded for the auditor.
- AI Spend TrackingInteractions, Copilot credits and Azure tokens in one ledger per agent - with the spend column next to what each agent can reach.
- Microsoft 365 User Access ReviewEvery identity with what it can reach, what it did, and whether it should still exist - including SharePoint-only guests that live outside the directory.
- Group Access AnalysisWhat membership in a group actually unlocks - nesting resolved, external members surfaced, blast radius counted.
- App and OAuth Consent GovernanceEvery app with a foothold in the tenant: how it got in, who let it in, and what it can actually read.
- Remediation AutomationFindings become fixes at tenant scale, counted before you enable them and staged behind a review window.
- Microsoft 365 Licence OptimizationThe seats you pay for and nobody uses - unassigned units, licences on guests, and dormant accounts still billing.
- Microsoft 365 Anomaly DetectionEvery policy, user, app and agent measured against its own baseline - with an alert line you move and see the answer to at once.
- Office 365 Sign-in LocationsEvery place your tenant is reached from, with your Conditional Access configuration laid over observed reality.
- Microsoft 365 Unified Audit LogWho did what, when, from where and on which device - retained up to three years on a standard licence.
- SharePoint Site InventoryEvery site, channel site and OneDrive in one list, ranked by external reach, abandonment and what Copilot can read.
- Microsoft 365 Activity AnalyticsThe extremes rather than the averages - a mass download inside the hour, and everything nobody has touched in a year.
- Microsoft 365 Trend TrackingAny number in the tenant followed over time, with the change and the deviation attached - and alerting on the same object.
- Microsoft 365 Compliance MonitoringReadiness for eleven regulations measured from live tenant data - with weekly snapshots and a dated evidence pack per framework.
- Microsoft 365 Security ScoreMicrosoft Secure Score beside the score measured from what actually happens - one worklist ranked by points still on the table.
- External Domain MonitoringEvery organisation your tenant exchanges data with, resolved to a real company - with drift flags and an enforceable verdict per domain.
- All featuresExplore everything
Find the links that never closed.
Connect read-only and see your public + sensitive + permanent list the same day - then remove it with a review window in front of every change.
Or keep trusting that nobody ever forwards a URL.