How to Audit Sharing Settings in SharePoint Online

For organizations collaborating with a wide range of users, including external parties, it's crucial to manage access permissions levels to site contents. You can change the sharing settings by navigating to the Sharing page of your SharePoint admin center.

• This report helps you to identify the external sharing level, sharing allowed and blocked domains, etc., of all the site collections.
• Use AdminDroid’s built-in charts to visually classify your site collections based on their sharing levels.

Handy Hint: You can use the Report scheduling functionality to receive a weekly report on the sharing settings of your SharePoint Online sites.

The organization-wide sharing setting is not applied to all the SharePoint sites in your organization. Each site type has its own default sharing level irrespective of the organization-wide setting.

The default external sharing setting of each site type is mentioned below.

Note: Classic, communication, and modern sites (without a group) will always have the Only people in your organization setting, regardless of the organization-wide setting. However, for group-connected sites, the default setting may vary based on your organization-wide setting.

For example, if your organization-wide setting is restrictive, such as Existing guests, then all group-connected sites will adopt this as default setting. Similarly, if the organization-wide setting is set to the most restrictive level like Only people in your organization, then all group-connected sites will have this as the default setting.

The default sharing setting based on site types may not suit your organization’s purpose. Some confidential sites may require more restricted access, while common sites may require more permissive access.

Follow the steps below to change the sharing settings for individual sites in SharePoint Online.

Note: Here, you may notice that some of the sharing settings are greyed out. This is because you might have restricted those settings in your organization-wide sharing settings.

You can also use Microsoft 365 sensitivity labels to control the default sharing link settings for sites and documents. The more restrictive setting between these two will be the default sharing link for the documents.

Run the below PowerShell cmdlet to configure the default sharing link type of sensitivity labels.

Connect-IPPSSession -UserPrincipalName <UPN>

Set-Label -Identity "<LabelName>"-AdvancedSettings @{DefaultShareLinkPermission = "View" DefaultSharingScope = "SpecificPeople"}

Note: Make sure to replace <UPN> and <LabelName> with the appropriate values before executing the cmdlets.

Now, the documents or sites with this label will have the default sharing link as "People you choose" and sharing permission as "View". If required, you can also customize the DefaultShareLinkPermission and DefaultSharingScope parameters with other values as mentioned below.

If everyone on a SharePoint Online site can share the site and its content, it raises the risk of document overwrites, which could result in data loss or corruption. Without proper management, confidential documents may be exposed to unwanted users.

You can prevent users from sharing files in SharePoint Online by following the steps below.

You can audit sharing permission setting changes by selecting the "Modified Members Can Share" setting under Activity in your Office 365 audit logs. However, preparing the report may take more time if it includes multiple events.

• This report provides information on who modified the setting and the time it was modified.
• You can use the Site URL easy filter to view the sharing permission modifications for specific SharePoint Online sites.

If you find any compliance documents on your internal document site being shared with "Anyone" links or Edit permissions, follow these steps to disable the sharing link in SharePoint Online.