What is external sharing?
Also known as
Definition
External sharing is how people inside your organization share files, folders, sites, and collaboration spaces with people who don't have a Microsoft 365 account in your tenant. That includes partners, vendors, clients, and contractors. It can happen through guest accounts, through sharing links, or both.
External sharing is on by default in Microsoft 365. That doesn't mean everything is shared externally. It means users can share externally if they choose to, at the site and file level.
tip
The goal is visibility: knowing what's shared externally, with whom, and whether it still makes sense.
Why it matters
External sharing is how your organization works with people outside it. The question isn't whether to allow it. It's how to keep track of it.
- Business collaboration: External sharing makes it possible to work with people outside your organization without giving them a full Microsoft 365 account.
- Governance & security: External access doesn't expire on its own. A guest invited for a project six months ago still has access unless someone removed it.
- Migration: When you migrate a tenant, external access is part of the state you're moving. If you don't know what's shared externally before cutover, you can't rebuild it in the target environment.
What we see out there
Microsoft native tools don’t show the full picture.
Getting a complete, actionable view across the whole tenant is challenging: which workspaces have external access, who owns them, and whether that access still makes sense. Additionally, acting on it at scale is where organizations get stuck.
Sharing links break after migration.
Sharing links from the source environment point to a location that no longer exists after a tenant migration. They have to be recreated.
Frequently asked questions
What types of external sharing exist in Microsoft 365?
There are three types of sharing links in Microsoft 365.
- Anyone links give access to whoever has the link. No sign-in is needed, and the access can't be audited.
- Specific people links need the recipient to authenticate.
- People in your organization links work only for internal users.
The type of link matters because it determines who can reach the content, whether they have to prove who they are, and whether IT can track what's happening.
How do we review external guests?
The SharePoint admin center has sharing activity reports. Once you know what's shared and with whom, you can work through it by workspace: confirm with the owner whether each guest still needs access and remove access for anyone who doesn't.
ShareGate Protect's Sharing links report lists every file and folder shared via anonymous or company-wide links across your tenant: link type, who created it, when, who it's shared with, and which site it lives on. From there you can remove links directly or set up automated Sharing Links policies that run daily and delete links matching your conditions automatically. The Remediation impact section on the overview page tracks how many external and anonymous links you've removed over time, so you can see the progress you're making.
What happens to external sharing during a migration?
Sharing links break. They point to a source environment that no longer exists after migration, so anyone using an old link will lose access. Explicit permissions granted through those links can be migrated, but the links themselves can't be preserved. Guest accounts need to be reviewed before migration: carry over only the guests who still need access and confirm they'll have accounts in the target tenant. Any guests not recreated in the target will lose access on cutover.
How do sensitivity labels affect external sharing?
Sensitivity labels can control whether external sharing is allowed on a site or file at all. When a label is applied to a site, it can enforce settings like disabling Anyone links, requiring guests to authenticate, or turning off external sharing entirely for that site. That means classification drives sharing behavior automatically, rather than relying on users to make the right choice each time. A site labeled Confidential can be set to prevent external sharing regardless of what the site owner does.
