External Sharing in SharePoint and OneDrive: A Planning Guide for Small Firms

External sharing in SharePoint and OneDrive lets your staff share files with clients, vendors and partners without email attachments. To plan it well, decide three things: how open sharing can be across the company, what kind of link people get by default, and how guest access is reviewed and removed. Most small firms are best served by allowing sharing with signed-in guests, defaulting to Specific people links, and either turning off or tightly limiting links that anyone can open.

Why it matters

Microsoft turns external sharing on by default, and Microsoft recommends leaving it on, because a governed share is safer than files sent as attachments or through personal Dropbox accounts. The risk is in the defaults nobody revisits: links that never expire, links that anyone can forward, and guest accounts that stay active long after a project ends.

This guide covers sharing with people outside your company. For organizing internal sites and permissions, see our guide to organizing SharePoint for a small business.

The four sharing levels

In the SharePoint admin center, the External sharing setting has four levels. You set them separately for SharePoint and OneDrive, and the OneDrive setting cannot be more permissive than the SharePoint one.

Default link type and permission

The File and folder links setting controls which link people see first when they click Share. The options are Specific people, Only people in your organization, and Anyone with the link (available only if the organization allows Anyone). You also choose whether the default link grants view or edit permission.

Defaults matter because most people accept them. Setting the default to Specific people with view permission means a link only works for the named recipients, and editing is a deliberate choice.

Expiration and limits for Anyone links

If you allow Anyone links, use the advanced settings for them. You can require all Anyone links to expire within a set number of days, and you can restrict them to view only. Microsoft notes that the Request files feature needs Anyone links with upload permission, so check this if staff collect documents from clients that way.

Separately, the setting Guest access to a site or OneDrive will expire automatically after this many days lets you end guest access after a set period, so short-term collaborators do not keep access indefinitely.

Per-site settings

Each site can be set to be the same as, or more restrictive than, the organization setting, but never more open. A SharePoint Administrator changes this under Active sites by selecting the site and choosing More sharing settings; site owners cannot change it themselves. A site can also have its own default link type and its own list of allowed or blocked domains.

A common pattern is to keep internal sites such as HR and Finance at Only people in your organization, and allow guests only on client-facing project sites. Note Microsoft's defaults: communication sites start at Only people in your organization, while sites connected to Teams or Microsoft 365 groups usually allow new and existing guests.

Guest accounts and access reviews

Every guest who signs in becomes an account in your directory. Assign each client-facing site an internal owner who is responsible for its guests, and review guest accounts on a regular schedule.

Microsoft Entra access reviews can automate this by asking owners to confirm or remove each guest. They require Microsoft Entra ID P2 or Microsoft Entra ID Governance, which most small-business Microsoft 365 plans, including Business Premium, do not include as of this writing. Without them, a scheduled manual review of the Guests list in the Microsoft 365 admin center works fine for most small firms.

A simple external sharing policy for small firms

Adapt this to your firm and put it in writing:

A worked example

Take a hypothetical 14-person architecture firm sharing drawings with clients and consultants. It allows New and existing guests on project sites, sets the default link to Specific people, turns off Anyone links, and sets guest access to expire after 180 days. Each project manager owns the guests on their project site and clears them at closeout.

Common mistakes

How NexJen can help

Our SharePoint Online consulting engagement is a fixed-scope, advisory review of your sharing settings and site structure. We take a read-only look, then deliver written, risk-rated findings and a roadmap on a readout call; we do not change your tenant during the engagement. The fee is quoted from your tenant size and scope. If you would like us to put the changes in place, we quote that separately or handle it under NexJen Essentials.

Common questions