How to find "anyone-with-the-link" sharing in Microsoft 365

If you run IT for a company on Microsoft 365, the single most common way data leaves the building isn't a dramatic breach - it's an "anyone with the link" share that someone created two years ago and forgot. These links work without sign-in, don't expire by default, and are trivial to forward. From a GDPR standpoint they are an uncontrolled disclosure waiting to be noticed.

This guide shows how to find them, decide which ones matter, and close the gap.

Why anonymous links are the quiet risk #

A standard SharePoint or OneDrive share can be one of three kinds:

• Specific people - scoped to named users; the safest.
• People in your organisation - anyone signed in to your tenant.
• Anyone with the link - no sign-in, no audit of who opened it. This is the one to hunt.

The problem isn't that anonymous links exist; sometimes they're intentional. The problem is that nobody has an inventory of them, so you can't tell a deliberate share of a public brochure from an accidental share of a folder full of payroll exports.

Step 1 - Turn off "anyone" links going forward (if you can) #

Before auditing the backlog, stop the bleeding. In the SharePoint admin centre, Policies → Sharing, you can set the default link type to "Specific people" and restrict or disable "Anyone" links org-wide or per site. Even setting an expiry on anonymous links (e.g. 30 days) dramatically shrinks the long tail.

Change the default first. Otherwise every audit you run is chasing a number that keeps growing.

Step 2 - Inventory what already exists #

The exposure already created won't fix itself. You have a few options:

• SharePoint admin reports give a coarse, site-level picture but not a per-file list of anonymous links.
• Microsoft Graph can enumerate sharing permissions per drive item, but writing and running that across every site, OneDrive and Teams library is a real scripting project - and you have to store and re-run it to track drift.
• A read-only scanner that walks the tenant via Graph and reports every anonymous link, who owns it, and how exposed it is, without you writing any PowerShell.

Whichever route you take, the output you want is the same: a list of items shared anonymously, sortable by sensitivity and age.

Step 3 - Triage by blast radius, not by count #

A list of 4,000 anonymous links is paralysing. Sort by what actually matters:

• Scope - a shared folder or whole library is far worse than a single file.
• Sensitivity - finance, HR, legal and customer-data sites first.
• Age and owner - links from ex-employees, or older than your new expiry policy, are prime candidates to revoke immediately.

Fix the top of that list and you've removed most of the real risk in an afternoon.

Step 4 - Make it a monthly habit #

Sharing posture drifts. New links appear every week as people collaborate. The teams that stay clean don't do one heroic cleanup - they re-scan monthly, watch the trend line, and act on the new top-of-list items. A 15-minute monthly review beats an annual fire drill.

A quick checklist #

• Default link type set to "Specific people"
• Expiry enabled on any "Anyone" links you still allow
• A current inventory of existing anonymous links
• Top exposures (folders, sensitive sites, ex-employee shares) revoked
• A recurring monthly re-scan on the calendar

Anonymous sharing is rarely malicious and almost always invisible until someone looks. The fix is mostly about visibility - once you can see the list, the decisions are easy.

FAQ #

How do I see who has access to a SharePoint file? #

Open the file's sharing details and check which of the three link types is in use: specific people, people in your organisation, or anyone with the link. The first two are scoped to named users or to signed-in accounts in your tenant, so you can see exactly who is covered. An "anyone with the link" share is the exception, because there is no sign-in and no audit of who opened it, so the file's own permissions cannot tell you who actually has access.

Do anonymous sharing links in Microsoft 365 expire? #

Not by default. An "anyone with the link" share stays live until somebody revokes it, which is why links created years ago are still working today. You can change this in the SharePoint admin centre by enabling an expiry on any "Anyone" links you still allow, for example 30 days, which dramatically shrinks the long tail of forgotten shares.

Will disabling anonymous sharing break links that already exist? #

Changing the default link type and restricting "Anyone" links stops new anonymous shares from being created, but it does not clean up the exposure already out there. The backlog will not fix itself, so treat the policy change and the audit as two separate jobs. Change the default first, otherwise every audit you run is chasing a number that keeps growing.

How do I find every anonymous link across a whole tenant? #

SharePoint admin reports give you a coarse, site-level picture rather than a per-file list, so they are not enough on their own. Microsoft Graph can enumerate sharing permissions per drive item, but running that across every site, OneDrive and Teams library is a real scripting project, and you have to store and re-run it to track drift. The alternative is a read-only scanner that walks the tenant via Graph and reports every anonymous link, its owner and how exposed it is, without you writing any PowerShell. Either way, the output you want is the same: a list of anonymously shared items, sortable by sensitivity and age.