How to check external sharing settings in SharePoint Online

Before you start

Use an account with the SharePoint Administrator role, for PowerShell and for the admin centre. To read a site with Get-SPOSite, Microsoft says the account must also be a site collection administrator.

The settings are read live. The examples read and export and change nothing. In PowerShell 7 the module must be loaded through Windows PowerShell, which the last line of the install block does.

Option 1

Check external sharing settings with PowerShell

Install the module once, then connect and export the tenant's settings and each site's. The connection prompts you to sign in, so the script holds no password. Replace contoso with your tenant's name.

# Install once, if the module is not already installed.
Install-Module Microsoft.Online.SharePoint.PowerShell -Scope CurrentUser
# In PowerShell 7 only: load the module through Windows PowerShell.
Import-Module Microsoft.Online.SharePoint.PowerShell -UseWindowsPowerShell

$ErrorActionPreference = 'Stop'
Connect-SPOService -Url 'https://contoso-admin.sharepoint.com'
try {
    $tenantSettings = 'SharingCapability', 'OneDriveSharingCapability', 'DefaultSharingLinkType',
        'SharingDomainRestrictionMode', 'RequireAnonymousLinksExpireInDays'
    Get-SPOTenant | Select-Object $tenantSettings |
        Export-Csv -Path './sharepoint-tenant-sharing.csv' -NoTypeInformation -Encoding utf8

    # -Limit does not fill SharingCapability, so read each site again by its address.
    $urls = @(Get-SPOSite -Limit All | Select-Object -ExpandProperty Url)
    if ($urls.Count -eq 0) {
        Write-Output 'No sites were returned.'
    } else {
        $sites = @(foreach ($url in $urls) { Get-SPOSite -Identity $url })
        $sites | Select-Object Url, Title, Template, Owner, SharingCapability |
            Export-Csv -Path './sharepoint-site-sharing.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($sites.Count) sites written to sharepoint-site-sharing.csv."
    }
} finally {
    Disconnect-SPOService
}

The tenant file holds 5 settings, described on Microsoft's Set-SPOTenant page. SharingCapability is who can be shared with; its values are the admin centre's options under other names:

• ExternalUserAndGuestSharing: Anyone, which allows links that open without signing in.
• ExternalUserSharingOnly: New and existing guests.
• ExistingExternalUserSharingOnly: Existing guests.
• Disabled: Only people in your organization.

The site file reads each site by its address, which is slow on a large tenant. To narrow it, add -Template GROUP#0 to the list step for group sites, or -IncludePersonalSite $true for OneDrives. Do not add -Detailed: Microsoft has deprecated it.

Check a single site

Run this while connected. It reads 1 site beside the tenant.

# Replace the example address.
Get-SPOTenant | Select-Object SharingCapability
Get-SPOSite -Identity 'https://contoso.sharepoint.com/sites/research' |
    Select-Object Url, Title, SharingCapability

Option 2

Review external sharing in the admin centre

1. Sign in to the SharePoint admin centre as a SharePoint Administrator.
2. For the tenant, expand Policies and select Sharing.
3. Under External sharing, read the level set for SharePoint and for OneDrive. OneDrive can be narrower than SharePoint, not wider.
4. Expand More external sharing settings for domain limits, guest expiry and link settings.
5. For a site, go to Sites > Active sites and select the site.
6. On the Settings tab, select More sharing settings and read the option chosen. Close the panel without saving.

This suits reading the tenant's settings and a few sites. For every site at once, use PowerShell or Altivane.

Common questions

Why does Get-SPOSite -Limit All not show the real sharing setting?

Microsoft says that when -Limit or -Filter is used, some site properties, SharingCapability among them, are not populated and may hold a default value. The script lists sites with -Limit All, then reads each one by its address.

Does this show which files or links are shared?

No, settings only. With the admin tier, Altivane's report also lists the sites and OneDrives that allow Anyone links, and the guests SharePoint knows about. For another way data leaves an organisation, see how to find mailbox forwarding in Exchange Online.

Why does Altivane say Needs the admin tier?

The report could not reach SharePoint's admin API. The per-site parts, some settings and the guests need Sites.FullControl.All on the SharePoint API. The rest of the report still runs.