Published: 11 June 2026 | Category: Governance and Permissions
Shared links in SharePoint Online do not time out by default. Every link created for external access in your organisation remains valid until someone explicitly revokes it, or until an expiry policy is enforced. Expiry is disabled by default for most tenants. That means every "Anyone" link generated by a user sharing a file for a contractor review, a client handoff, or a one-week project collaboration is still active years later unless someone actively removes it.
Most SharePoint admins know this intellectually. Far fewer have a clear answer to the more practical question: how often should the review actually happen? The answer depends on your organisation's risk profile, sharing volume, and regulatory environment, but there is a defensible baseline and a set of trigger events that should prompt an out-of-cycle review regardless of your regular schedule.
Why External Sharing Links Accumulate So Quickly
SharePoint's external sharing features are deliberately easy to use. A user opens a document, clicks Share, types an email address or copies a link, and the file is accessible externally within seconds. That low friction is by design. Microsoft built the feature to remove barriers to collaboration across organisational boundaries. The trade-off is that the same ease applies to accumulation: links build up at the speed of daily work, but removal requires deliberate action.
Two types of external sharing exist in SharePoint Online, and they accumulate differently. "Anyone" links (sometimes called anonymous links) require no sign-in and are usable by anyone with the URL. Direct shares to specific external email addresses create Entra ID guest accounts in your tenant directory. Both types sit in the same sharing report, but they have different risk profiles. An anonymous link shared to a contractor three years ago still works if the contractor forwards the URL to someone else. A direct share to a former employee's personal email address creates a guest account that may still have active access to multiple libraries.
Multiply that by the number of users in an active collaboration environment and the typical sharing volume becomes large. A 200-person organisation where each user creates a handful of external shares per year accumulates hundreds of links annually. Over three years without a review, that is a large, unaudited body of active external access grants on files whose sensitivity and ownership may have changed entirely.
What Sits in an Unreviewed Sharing Report
When organisations run their first thorough external sharing audit, the report almost always contains a predictable mix of entries. The common categories:
- Post-project links: shares created for contractors or clients during a project that ended months or years ago. The project files are still accessible to people who no longer have any business need to see them.
- Departed employee shares: links created by employees who have since left. The user account is disabled, but the sharing link they created remains valid. If the link is an Anyone link, the departure of the original owner has no effect on its validity.
- Elevated-permission shares: shares that were created with edit access because the user did not change the default, even though the recipient only needed to read the document. Edit access on a file that should have been view-only is a consistent finding in external sharing audits.
- Forgotten library-level shares: shares applied at the folder or library level rather than the file level, which grant access to everything in that container, including content added after the original share was created.
The most common finding in a first external sharing audit is not malicious intent; it is scale. Organisations are often surprised not by individual bad actors but by the volume of legitimate-at-the-time shares that have quietly accumulated into a large uncontrolled access footprint.
When Should You Audit SharePoint External Sharing?
A regular cadence is the baseline - trigger events override it. Both matter.
Baseline cadence by organisation type:
- Low external-sharing volume (small internal team, rare contractor use): annual review is a reasonable minimum. Pull the sharing report from the Microsoft 365 admin center once a year and clear out anything no longer justified.
- Moderate sharing volume (project-based work with external partners, occasional client deliverables): quarterly reviews. Three months is long enough for a meaningful volume to accumulate and short enough that the review remains manageable in a single session.
- High sharing volume (agencies, MSPs, consulting firms, teams with permanent external collaborators): monthly reviews. At this volume, quarterly gaps are large enough for significant stale access to build up between cycles.
- Regulated industries (finance, healthcare, legal, government): monthly reviews at minimum, with formal documentation of each review cycle for audit evidence. Some regulatory frameworks specify access review frequency explicitly.
Trigger events that require an out-of-cycle review:
- A staff member or contractor is offboarded. Check all shares they created and all guest accounts associated with their projects.
- A project, engagement, or contract ends. Any shares created for that project's external participants should be revoked unless there is an explicit reason to retain access.
- A file or library is reclassified to a higher sensitivity level. Check whether existing external shares on that content are still appropriate for the new classification.
- An acquisition, merger, or significant organisational change affects team structure. External sharing patterns frequently reflect old organisational boundaries that no longer apply.
What a SharePoint External Sharing Review Covers
A thorough review covers more than just the list of active links. The questions worth asking in each cycle:
- Which files and folders have active Anyone links? Are any of them sensitive or no longer in active use?
- Which external guest accounts are still active in Entra ID, and which have not signed in for 90 or more days?
- Are any library-level or folder-level shares granting access to more content than originally intended?
- Do any shares carry edit permissions where view-only access would have been sufficient?
- Are there shares created by employees who have since been offboarded?
Answering these questions from the Microsoft 365 admin center is possible but time-consuming. The built-in sharing reports show active links per site, but cross-site visibility requires navigating to each site's settings, or exporting multiple CSVs and joining them manually in Excel.
Tooling for External Sharing Audits
The admin center's built-in sharing report enumerates active links per site but offers no cross-tenant view or bulk-remove action. PnP PowerShell covers the gap: Get-PnPSharingLink and related cmdlets give full access to sharing data and work well for teams who want to automate or pipeline the review. ShareMaster's Shared Links and Permissions tool offers the same tenant-wide visibility and a built-in bulk-remove action, without scripting.
The right choice depends on how frequently the review needs to run and whether automation is a priority. For a quarterly manual review, a GUI-based tool produces faster results with less setup. For a monthly automated review on a high-volume tenant, a PowerShell pipeline that emails a summary report is worth the initial investment. See the detailed breakdown in the external sharing audit options comparison.
Whichever tooling you choose, the practical step-by-step process for a single-cycle review is covered in the SharePoint shared links audit guide, including what to look for, how to interpret the report, and how to bulk-revoke links that no longer serve a current business purpose.
Frequently Asked Questions
How often should you review SharePoint external sharing links?
For most organisations, quarterly is the right baseline. Teams with high sharing volume or in regulated industries benefit from monthly reviews. Key trigger events, such as staff offboarding or project closeout, warrant an out-of-cycle review regardless of the regular schedule.
Do SharePoint external sharing links expire automatically?
Not unless an expiry date is configured. In the default Microsoft 365 configuration, sharing links do not expire automatically. Tenant admins can set a maximum link lifetime for Anyone links in the SharePoint admin center, but this must be configured deliberately and does not retroactively affect existing links.
What is the difference between an Anyone link and a guest share in SharePoint?
An Anyone link can be used by anyone with the URL, with no sign-in required. A guest share sends an invitation to a specific email address, creating an Entra ID guest account in your tenant. Anyone links carry higher risk because they are not identity-bound: anyone who receives the URL can use it, regardless of whether they were the intended recipient.