How to Manage External Sharing Settings in SharePoint and OneDrive at Scale Sharing files through SharePoint and OneDrive makes it easier to collaborate with people outside your organization. However, if access permissions are not reviewed regularly, that convenience can quickly become a security risk. In this video, we’ll show you how to manage external sharing safely. Before we begin, be sure to subscribe to NinjaOne’s IT video hub and our YouTube channel for more tech content like this. Method 1: Configure External Sharing via Microsoft 365 Admin Center This method gives administrators more control over anonymous access, guest sharing, and link expiration. Go to the SharePoint admin center and sign in with an admin account. Select Sharing, then choose one of the four available external sharing levels. You can set it to: Anyone, which is the most permissive, New and existing guests, Existing guests, and Only people in your organization. Next, set the default link type, choose View or Edit, and define how long anonymous links remain active. Repeat the same steps under OneDrive > Sharing, then save your changes to apply them tenant-wide. Method 2: Configure Site-Level Sharing Policies via PowerShell This PowerShell method lets you apply stricter external sharing rules at the site level when certain sites need higher security. The available -SharingCapability options include: Once you have installed and imported the SharePoint Online Management Shell, connect to SharePoint Online with an elevated PowerShell session with this command: To audit the current sharing settings before making changes, run: Next, to apply your desired external sharing policy, run... Keep in mind that the available -SharingCapability options are: Disabled, ExternalUserSharingOnly, ExternalUserAndGuestSharing, ExistingExternalUserSharingOnly To apply the policy across all SharePoint sites, run: Method 3: Automate Sharing Policy Audits With Microsoft Graph For this method, make sure that you have the Microsoft Graph PowerShell SDK installed and that the appropriate Microsoft Graph API scopes, including Sites.Read.All and Reports.Read.All, have been granted. After installing Microsoft Graph PowerShell SDK, connect to Microsoft Graph and retrieve site and sharing metadata using an elevated PowerShell session using the following command: Note: Keep in mind that if you use app-based or non-interactive authentication, you have to register an application in Microsoft Entra ID and grant the required API permissions. Next, get a list of all SharePoint sites by running this command: Each site object should include metadata such as the site ID, web URL, and display name. The SharingCapability property may not appear in all Microsoft Graph PowerShell SDK versions or tenant configurations. If the property is unavailable, use the following alternative command: Optionally, export the results to CSV format to generate reports that help track external sharing activity and access patterns. Finally, automate the script execution using scheduled tasks or NinjaOne RMM scripting. Managing external sharing in SharePoint and OneDrive is most effective when using a layered and scalable security approach. By setting global defaults, applying site-level controls, and regularly auditing access, you can minimize risk while maintaining easy collaboration. For more information, please refer to our official blog post on managing external sharing settings in SharePoint and OneDrive, which is available in the description below.