How to find "anyone-with-the-link" sharing in Microsoft 365

If you run IT for a company on Microsoft 365, the single most common way data leaves the building isn't a dramatic breach - it's an "anyone with the link" share that someone created two years ago and forgot. These links work without sign-in, don't expire by default, and are trivial to forward. From a GDPR standpoint they are an uncontrolled disclosure waiting to be noticed.

This guide shows how to find them, decide which ones matter, and close the gap.

Why anonymous links are the quiet risk

A standard SharePoint or OneDrive share can be one of three kinds:

• Specific people - scoped to named users; the safest.
• People in your organisation - anyone signed in to your tenant.
• Anyone with the link - no sign-in, no audit of who opened it. This is the one to hunt.

The problem isn't that anonymous links exist; sometimes they're intentional. The problem is that nobody has an inventory of them, so you can't tell a deliberate share of a public brochure from an accidental share of a folder full of payroll exports.

Step 1 - Turn off "anyone" links going forward (if you can)

Before auditing the backlog, stop the bleeding. In the SharePoint admin centre, Policies → Sharing, you can set the default link type to "Specific people" and restrict or disable "Anyone" links org-wide or per site. Even setting an expiry on anonymous links (e.g. 30 days) dramatically shrinks the long tail.

Change the default first. Otherwise every audit you run is chasing a number that keeps growing.

Step 2 - Inventory what already exists

The exposure already created won't fix itself. You have a few options:

• SharePoint admin reports give a coarse, site-level picture but not a per-file list of anonymous links.
• Microsoft Graph can enumerate sharing permissions per drive item, but writing and running that across every site, OneDrive and Teams library is a real scripting project - and you have to store and re-run it to track drift.
• A read-only scanner that walks the tenant via Graph and reports every anonymous link, who owns it, and how exposed it is, without you writing any PowerShell.

Whichever route you take, the output you want is the same: a list of items shared anonymously, sortable by sensitivity and age.

Step 3 - Triage by blast radius, not by count

A list of 4,000 anonymous links is paralysing. Sort by what actually matters:

• Scope - a shared folder or whole library is far worse than a single file.
• Sensitivity - finance, HR, legal and customer-data sites first.
• Age and owner - links from ex-employees, or older than your new expiry policy, are prime candidates to revoke immediately.

Fix the top of that list and you've removed most of the real risk in an afternoon.

Step 4 - Make it a monthly habit

Sharing posture drifts. New links appear every week as people collaborate. The teams that stay clean don't do one heroic cleanup - they re-scan monthly, watch the trend line, and act on the new top-of-list items. A 15-minute monthly review beats an annual fire drill.

A quick checklist

• Default link type set to "Specific people"
• Expiry enabled on any "Anyone" links you still allow
• A current inventory of existing anonymous links
• Top exposures (folders, sensitive sites, ex-employee shares) revoked
• A recurring monthly re-scan on the calendar

Anonymous sharing is rarely malicious and almost always invisible until someone looks. The fix is mostly about visibility - once you can see the list, the decisions are easy.