SharePoint external sharing
Which sites are still shared outside your company for projects that ended?
In a typical tenant, 20-200 SharePoint sites have had no internal activity for a year while external users or guests still hold access - and IT usually knows about a handful of them. 1Security lists every site with its external users, guests and anyone links, ranks them by what is inside, and closes the ones nobody would defend behind a review window.
The problem
External access is granted per project. It is never revoked per project.
A site gets external access the week a project starts: a partner is invited, a channel is shared, a vendor gets a folder. Then the project ends, the team moves on, and nobody has "close what we opened" in their job description. Most tenants hold several times more sites than IT believes they have - subsites, hub members, private and shared channel sites and every personal OneDrive are all sites with their own sharing.
A site's sharing setting says what is allowed. Who can actually get in is a longer list: the external user added directly in 2023, the guest inside a Microsoft 365 group, the SharePoint-only guest who came in through a link or a site permission, the anyone link on a folder three levels down. 1Security resolves every one of those entrances per site, so the audit starts from who can get in, not from a setting.
That is why the dangerous pattern in most tenants is not "too much sharing". It is abandoned-but-shared: sites with no internal activity for a year that still have external users attached. In our experience the list is usually short, often shocking, and always immediately actionable.
In practice
One list, site by site, door by door.
How the SharePoint external sharing audit runs in 1Security - and how it stays done afterwards.
- 01
Rank sites by external exposure
Open Sites and sort by external users. Each row shows external users, SharePoint-only guests, anyone links, direct versus indirect access and the groups that grant it - so you see not just how many people can enter a site, but through which door. Subsites, hub sites, private and shared channel sites and OneDrives are all rows.
- 02
Apply the abandoned-but-shared filter
Filter to no activity in the last year and external users present. In a mid-size tenant this returns tens of sites; in a large one, hundreds. Every one of them is a finished project still open to someone outside.
- 03
Check what the open sites contain
Sensitivity labels and detected sensitive information are columns on the same list. Sort by sensitive detections and the order of work is obvious: an open archive of lunch menus and an open archive of contracts are different emergencies.
- 04
Close the doors and keep the receipt
Enable the suggested automation - remove external users from inactive sites, tighten sharing capability, set external-access expiry - and each site gets a staged proposal with a 72-hour review window and optional owner confirmation. Every executed change is logged in Actions.
What makes it work
Three parts of the platform behind the audit.
The site view is one end of every share. The link inventory on Files is the other - together they cover both.
SharePoint governance
Every site ranked by external exposure and abandonment, with per-site sharing settings automations to close what should be closed.
Explore the feature →Inventory
The full site count first - subsites, hubs, channel sites and OneDrives - because you cannot audit the sites you have not counted.
Explore the feature →Access management
Effective access resolved through groups, inheritance and links, so "who can get in" is a resolved answer for every site.
Explore the feature →
FAQ
Common questions.
Does the audit include OneDrive?
Yes. Every personal OneDrive is a row on Sites with the same exposure columns - and in most tenants a surprising share of external sharing lives there, not on team sites.
How is this different from reviewing sharing settings site by site?
A per-site sharing setting tells you what is allowed on that site. 1Security shows the effective external access on every site at once - external users, SharePoint-only guests, anyone links, group-granted access - next to last activity, owners and sensitive content, and lets you filter and act on the whole list.
Will closing sharing break active collaborations?
Changes are staged behind a 72-hour review window with owner review, so the people who actually use a site can object before anything closes. A rejected proposal is snoozed, not lost, and every executed change is logged.
Do we need write permissions or E5 to run the audit?
No. The audit runs on the read-only connection and standard Microsoft 365 licenses. Write actions are a separate opt-in module - and until you enable it, every suggested cleanup still shows its live match count.
The 1Security platform
SharePoint External Sharing is just the beginning
SharePoint External Sharing is one screen of the 1Security platform for Microsoft 365. Locations, devices, apps, AI agents, logs, permissions, sensitive data, compliance, reports and actions run on the same read-only connection, on the licence you already have.
- DevicesRegistered, unregistered and shadow devices, attributed from activity rather than from an agent. The device nobody enrolled still shows up.
- Apps and consentEvery app with access to the tenant, what it can reach, who consented, and whether it still needs to.
- AI agents and CopilotThe agent registry: owners, reach, who each agent acts as, what Copilot will see. The EU AI Act checks per agent, accountable owner, instruction transparency and impact assessment, measured from the tenant. Readiness before the licences, governance after.
- Activity logs and forensicsUp to three years of searchable activity on a standard licence. What was opened, downloaded, shared, by whom, from where, on which device.
- Anomalies and detectionsSpikes in sharing, downloads, sign-ins, consent and agent activity, scored against each tenant’s own pattern, with curated response actions.
- Sensitive dataPersonal data, credentials, financial and health records found by our own classifiers, with a Microsoft second opinion where the client has it.
- Microsoft 365 Alerts ToolOne alert model across policies, activity and anomalies - with the evidence attached and the alert threshold in your hands.
- Microsoft 365 Monitoring ToolReal-time monitoring that catches a mass download while it is unfolding - across users, files, apps, AI agents and devices.
- Copilot Security ToolEvery AI agent's real blast radius - quantified before rollout, watched and constrained after.
- Shadow Device DetectionEvery device touching your data, reconstructed from real activity - including the machines that never enrolled anywhere.
- Impossible Travel DetectionLocations as identities, not IPs: country, city and network for every action, first-seen origins, travel timelines with verdicts - no E5, no P2.
- Conditional Access MonitoringDeclared Conditional Access compared against observed sign-ins: coverage verdicts, ungoverned traffic share, and the ranges your offices outgrew.
- Office 365 Access ManagementEffective access, resolved - who can reach what, through which grant, and one place to take it away.
- SharePoint Governance ToolEvery site ranked by exposure and abandonment - links, guests and Copilot access under control.
- Office 365 User ProvisioningLifecycle access from day one to offboarding - reach, dormant accounts and license reclaim in one flow.
- Microsoft 365 Audit ToolUp to three years of searchable activity history - every action tied to an actor, device and location.
- Microsoft 365 Inventory ToolEight live inventories on one permission graph - including the sites, devices and AI agents that were never registered anywhere.
- Office 365 ReportingAnswers, not exports - regulator-grade numbers, saved views and a read-only API for your SOC.
- Microsoft 365 File PermissionsWho has access to any file, and why - people, links, apps and AI agents on one map, with the fix in the same place.
- Sensitive Data DiscoveryWhere regulated data lives and everything that can reach it - two detection engines, no premium licence required.
- Office 365 Email MonitoringOutbound sensitive content, delegated-send abuse and whole-thread evidence that survives deletion.
- Purview Label CoverageWhat your sensitivity labels actually cover, and which of them protect anything at all.
- AI Agent InventoryEvery agent in the tenant with its real reach counted, its blueprint reviewed, and guardrails you can verify.
- AI Data RestrictionDeclare a data type off-limits to AI and every agent, app and user still reaching it becomes a live violation - recorded for the auditor.
- AI Spend TrackingInteractions, Copilot credits and Azure tokens in one ledger per agent - with the spend column next to what each agent can reach.
- Microsoft 365 User Access ReviewEvery identity with what it can reach, what it did, and whether it should still exist - including SharePoint-only guests that live outside the directory.
- Group Access AnalysisWhat membership in a group actually unlocks - nesting resolved, external members surfaced, blast radius counted.
- App and OAuth Consent GovernanceEvery app with a foothold in the tenant: how it got in, who let it in, and what it can actually read.
- Remediation AutomationFindings become fixes at tenant scale, counted before you enable them and staged behind a review window.
- Microsoft 365 Licence OptimizationThe seats you pay for and nobody uses - unassigned units, licences on guests, and dormant accounts still billing.
- Microsoft 365 Anomaly DetectionEvery policy, user, app and agent measured against its own baseline - with an alert line you move and see the answer to at once.
- Office 365 Sign-in LocationsEvery place your tenant is reached from, with your Conditional Access configuration laid over observed reality.
- Microsoft 365 Unified Audit LogWho did what, when, from where and on which device - retained up to three years on a standard licence.
- SharePoint Site InventoryEvery site, channel site and OneDrive in one list, ranked by external reach, abandonment and what Copilot can read.
- Microsoft 365 Activity AnalyticsThe extremes rather than the averages - a mass download inside the hour, and everything nobody has touched in a year.
- Microsoft 365 Trend TrackingAny number in the tenant followed over time, with the change and the deviation attached - and alerting on the same object.
- Microsoft 365 Compliance MonitoringReadiness for eleven regulations measured from live tenant data - with weekly snapshots and a dated evidence pack per framework.
- Microsoft 365 Security ScoreMicrosoft Secure Score beside the score measured from what actually happens - one worklist ranked by points still on the table.
- External Domain MonitoringEvery organisation your tenant exchanges data with, resolved to a real company - with drift flags and an enforceable verdict per domain.
- All featuresExplore everything
Find the sites that forgot they are open.
Connect read-only and see your abandoned-but-shared sites the same day - then close them with a review window in front of every change.
Or let finished projects keep their doors open another year.