🎯 SharePoint Course · Module 3 of 7
Sharing & External Access Policies
MS-102 Exam Alignment
MS-102
Manage SharePoint Online sharing and external access: Configure the tenant-wide sharing level, per-site sharing overrides, domain restrictions, sharing link types and expiry, and OneDrive sharing controls.
- Know the four external sharing levels in order from most to least permissive: Anyone → New and existing guests → Existing guests → Only people in your org
- Know that the tenant-level sharing setting is the ceiling — individual sites can only be more restrictive than the tenant level, never more permissive
- Know that Anyone links (anonymous links) do not create a guest account in Entra ID — anyone with the link can access the content without signing in
- Know that enabling external sharing at the tenant level does NOT automatically enable external sharing on existing sites — site-level settings must be checked separately
Exam Tip: SharePoint sharing levels are a hierarchy: the tenant is the ceiling, and each site can only restrict below that ceiling. If the tenant is set to “Existing guests only,” a site cannot be set to “Anyone” — the more permissive option is simply unavailable in the site settings UI. This is the most frequently tested SharePoint sharing concept on MS-102.
Sharing and external access configuration is the most security-critical administrative responsibility in SharePoint Online. A misconfigured sharing setting can inadvertently expose sensitive documents to anyone on the internet. Understanding the hierarchy of tenant-level and site-level controls — and how they interact — is essential for every SharePoint administrator.
🔗 The Four External Sharing Levels
| Level | Who Can Access Shared Content | Entra Guest Account Created? | Sign-In Required? |
|---|---|---|---|
| Anyone | Anyone who has the link — even if they don’t have a Microsoft account. This is anonymous sharing (also called “Anyone links”) | ❌ No — no identity verification | ❌ No — link works without authentication |
| New and existing guests | External users who are invited for the first time (new guests) OR who are already in the directory (existing guests) | ✅ Yes — new guest accounts are created in Entra ID on first access | ✅ Yes — guests must sign in |
| Existing guests only | Only external users who already have a guest account in your Entra ID directory — no new guests can be invited | ❌ No new guests — existing only | ✅ Yes |
| Only people in your organisation | No external sharing at all — content can only be shared with users inside the organisation | ❌ No external users | ✅ Internal users only |
⚠️ “Anyone” Links — The Anonymous Sharing Risk
When a user creates an “Anyone” link and shares it via email, anyone who receives that email (or if the link is forwarded) can access the content — no Microsoft account required, no sign-in, no audit trail of who accessed it. For this reason, most organisations either disable “Anyone” links entirely or configure them to expire automatically (7–30 days) and restrict link holders to view-only.
🏗️ Tenant vs Site Sharing Level — The Hierarchy
The tenant-level sharing setting (Policies → Sharing) is the maximum ceiling. Individual sites can only be set to an equal or more restrictive level.
SharePoint Sharing Hierarchy
TENANT: Anyone
↔ Sites can be set to: Anyone / New & existing guests / Existing guests / Org only
TENANT: New & existing guests
↔ Sites can be set to: New & existing guests / Existing guests / Org only
TENANT: Existing guests only
↔ Sites can be set to: Existing guests only / Org only
TENANT: Only org users
↔ Sites can ONLY be: Only people in your org
🔐 Sharing Link Types
| Link Type | Who Can Access | Authentication Required? | Admin Controls |
|---|---|---|---|
| Anyone (anonymous) | Anyone with the link — no account needed | ❌ No | Can be disabled at tenant or site level. Can set expiry (max days) and restrict to view-only |
| People in your organisation | Any authenticated user inside the organisation with the link | ✅ Yes (internal) | Cannot be shared externally. Good default for internal sharing |
| Specific people | Only the named individuals the sharer specifies (internal or external) | ✅ Yes | Most controlled link type. Creates targeted access for named users only |
| Existing access | Only for people who already have direct access to the item. Does not grant new access | ✅ Yes | No new permissions granted — purely a convenient link for existing collaborators |
⚙️ Sharing Policy Configuration
| Setting | What It Controls |
|---|---|
| External sharing — SharePoint | The tenant-wide maximum sharing level for all SharePoint sites. This is the primary external sharing dial |
| External sharing — OneDrive | The maximum sharing level for all users’ OneDrive. Must be equal to or more restrictive than the SharePoint tenant level |
| Limit external sharing by domain | Allow sharing only to specified domains, OR block sharing to specified domains. Mutually exclusive — allow list OR block list |
| Guests must sign in using the same account invitations were sent to | Prevents a guest from using a different email address to redeem the invitation |
| Allow guests to share items they don’t own | Controls whether external users can reshare items shared with them. Default: Off. Turn off to prevent cascade sharing |
| Anyone link settings — Maximum link expiration | Set a maximum number of days Anyone links can exist before automatically expiring (e.g., 30 days). 0 = no expiry |
| Anyone link settings — Link permissions | Restrict Anyone links to View only (no editing by anonymous users) |
| Default link type | What link type is pre-selected when a user opens the Share dialog — Anyone, People in your org, or Specific people |
PowerShell — Sharing Configuration
Connect-SPOService -Url https://your-tenant-admin.sharepoint.com # Get current tenant-wide sharing settings Get-SPOTenant | Select-Object SharingCapability,OneDriveSharingCapability,RequireAcceptingAccountMatchInvitedAccount # Set tenant sharing to 'New and existing guests' only (recommended baseline) Set-SPOTenant -SharingCapability ExternalUserSharingOnly # Require Anyone links to expire after 14 days maximum Set-SPOTenant -RequireAnonymousLinksExpireInDays 14 # Set a specific site to internal-only sharing (most restrictive) Set-SPOSite -Identity https://your-tenant.sharepoint.com/sites/HRSite -SharingCapability Disabled # Audit all sites to see their sharing levels Get-SPOSite -Limit All | Select-Object Title,Url,SharingCapability | Sort-Object SharingCapability
💡 Best Practices
- Set the tenant default sharing level to “New and existing guests” or “Existing guests only” — avoid “Anyone” at tenant level unless there is a specific business requirement
- Configure Anyone link expiry (14–30 days max) and restrict Anyone links to view-only — this limits the exposure window and prevents anonymous users from editing corporate documents
- Set high-sensitivity sites (HR, Finance, Legal, Executive) to “Only people in your organisation” individually in site sharing settings
- Prevent guests from resharing (Allow guests to share items they don’t own: Off) — this stops the cascade where Guest A shares content to Guest B who shares to Guest C without admin visibility
- Configure domain restrictions (allow list for known partner domains) when your organisation only legitimately shares with specific companies
🎓 Interview Q&A
Q: The tenant SharePoint sharing setting is “New and existing guests.” A site owner tries to set their site to “Anyone” (anonymous links). What happens?
The site owner will find that “Anyone” is not available as an option in their site’s sharing settings. The tenant-level sharing setting acts as a ceiling — individual sites can only be set to an equal or more restrictive level than the tenant. Since the tenant is set to “New and existing guests,” the site sharing options available are: “New and existing guests,” “Existing guests only,” or “Only people in your org.” The “Anyone” option is greyed out or not displayed. To enable “Anyone” links on a site, the tenant level must first be changed to “Anyone.”
🎯 MS-102 Mock Test
Module 3 — Sharing & External Access Policies
5 questions · Scenario-based · Pass mark: 70%
Q1 of 5
A user shares a document via an “Anyone” link with a partner. The partner forwards the email to a third party who opens the document. The SharePoint admin reviews the audit log but sees no entry for the third party’s access. Why?
AAudit logs only track internal user access — external users are excluded
B“Anyone” links do not require sign-in, so there is no authenticated identity to log — the access appears as anonymous in audit logs without individual user attribution
CThe audit log has a 24-hour delay for external user access events
DThe document must be in a document library for audit logging to apply
✅ B. “Anyone” links are truly anonymous — no sign-in is required to access the content. Because there is no authenticated identity, the audit log cannot attribute access to a specific individual. This is one of the major security risks of Anyone links: once shared, you lose visibility of who actually accessed the content. This is why limiting Anyone links to view-only and setting expiry is critical.
Q2 of 5
An organisation’s SharePoint tenant sharing is set to “Only people in your organisation.” A site owner wants to share a document with a contractor who has a personal Gmail account. What happens?
AThe site owner can share with the Gmail account — their site has its own separate sharing settings
BThe site owner can invite the Gmail user but they must create a Microsoft account first
CThe site owner sees a warning but can override the tenant setting for their site
DThe external share is blocked — when the tenant is set to “Only people in your org,” no external sharing is possible from any site regardless of site-level settings
✅ D. The tenant-level sharing setting is an absolute ceiling. When set to “Only people in your organisation,” external sharing is completely disabled across ALL sites in the tenant — site owners cannot override this. The Share dialog will not allow entering external email addresses. To enable sharing with the contractor, a SharePoint Administrator must first change the tenant setting to at least “Existing guests only.”
Q3 of 5
An organisation allows external sharing at the tenant level but wants to ensure that the HR site never shares content externally. What is the correct configuration?
ASet the HR site’s sharing to “Only people in your organisation” — this overrides the tenant setting for that specific site to restrict sharing
BCreate a Conditional Access policy blocking external users from the HR site
CSet the tenant sharing to internal-only to protect HR
DIt is not possible to restrict a site below the tenant level — all sites share the same setting
✅ A. Sites can always be set to a more restrictive level than the tenant. Setting the HR site to “Only people in your organisation” in its site-level sharing settings completely blocks external sharing for that site — even though the tenant allows external sharing for other sites. Setting the entire tenant to internal-only (C) would prevent other sites from sharing externally, which is unnecessarily restrictive.
Q4 of 5
A user shares a file using a “People in your organisation” link and the recipient forwards the email to an external partner. Can the external partner open the file?
AYes — “People in your organisation” links can be forwarded and work for anyone who has the link
BYes — but only if the external partner has a Microsoft account
CNo — “People in your organisation” links require authentication as a member of the organisation; external partners are denied access
DNo — the link automatically deactivates when forwarded to an email address outside the tenant domain
✅ C. “People in your organisation” links require authentication as a member of the organisation’s Microsoft 365 tenant. When an external partner tries to open the link, they are prompted to sign in — and since their account is not in your organisation’s directory, they are denied access. This makes “People in your org” links safe to send via email because forwarding the link to external recipients does not grant them access.
Q5 of 5
An organisation wants to prevent users from sharing SharePoint content to @competitor.com email addresses. What configuration achieves this?
ACreate a DLP policy blocking sharing with @competitor.com
BSharePoint admin center → Policies → Sharing → Limit external sharing by domain → Add competitor.com to the domain block list
CEntra ID → External collaboration settings → Block invitations to competitor.com
DSet the tenant sharing to “Existing guests only” and don’t invite competitor.com users
✅ B. The domain block list in SharePoint admin center → Policies → Sharing → “Limit external sharing by domain” → Block specific domains is the correct control. Adding competitor.com to the block list prevents users from sending sharing invitations to any @competitor.com email address — the sharing attempt will fail with a domain not allowed error.
🔒
Locked — Complete Module 2 first.