SharePoint External Sharing: How to Find and Revoke Old Links

External sharing is one of SharePoint's most useful features and one of its biggest security blind spots. Every time someone shares a file with a client, vendor, or contractor, a link is created that may persist long after the relationship ends. Over months and years, these links accumulate silently. The file that was shared with a freelancer in 2023 is still accessible in 2026. The anonymous link sent to a prospective partner's personal email can be forwarded to anyone. Without a deliberate process for finding and revoking old sharing links, external access grows in ways that no one in the organization fully understands.

Types of External Sharing in SharePoint

SharePoint supports three levels of external sharing, each with different security implications.

Anonymous links (Anyone links). These links grant access to anyone who has the URL, with no authentication required. The recipient does not need a Microsoft account or any form of sign-in. Anonymous links are the most convenient sharing option and the most dangerous. There is no audit trail showing who accessed the file, no way to verify the link was not forwarded, and no automatic expiration unless one was set at the time of sharing.

Authenticated guest links (New and existing guests). These links require the recipient to sign in with a Microsoft account or to verify their identity through a one-time passcode. The recipient appears as a guest user in Azure AD, which means their access can be tracked, reviewed, and revoked. This is significantly safer than anonymous sharing, but guest accounts can still linger indefinitely if no expiration policy is in place.

Specific people links. These links are restricted to named individuals and require the recipient to authenticate. They offer the tightest control because the link works only for the designated person. However, they are also the most cumbersome for the sender, which is why many users default to broader sharing options when they are in a hurry.

The risk gradient is clear: anonymous links carry the most risk, specific people links carry the least. Most organizations end up with a mixture of all three, often without a clear policy dictating when each type should be used.

The Risks of Stale External Sharing Links

External sharing links become a liability the moment the original purpose for sharing has passed. Several common scenarios create risk.

Former clients and vendors. A consulting engagement ends, but the shared project folder remains accessible. The external party may still be able to view updated documents, internal notes, or files added after the engagement closed.

Expired projects. Temporary collaborations often generate a burst of external sharing. When the project wraps up, no one goes back to revoke the links because there is no formal offboarding process for external collaborators.

Forwarded anonymous links. An anonymous link shared with one person can be forwarded to anyone. There is no way to know how many people have the URL or whether it has been posted somewhere public. This risk compounds over time -- the longer an anonymous link exists, the greater the chance it has been shared beyond its intended audience.

Compliance exposure. Regulations like GDPR and CCPA require organizations to control access to personal data. If a DSAR exemptions analysis reveals that personal data was accessible through a stale external link, the organization may face questions about whether adequate safeguards were in place. Demonstrating that external sharing is actively managed is a meaningful part of any compliance posture.

How to Audit External Sharing

Finding stale external links requires a combination of admin center reports and PowerShell scripts. Neither approach alone gives a complete picture.

SharePoint Admin Center Reports

The SharePoint admin center includes sharing activity reports that show which sites and files have been shared externally. Administrators can filter by site, date range, and sharing type. The report surfaces active external links, the users who created them, and the external recipients. This is the fastest way to get a high-level view of external sharing across the tenant, but it does not show anonymous links in granular detail and may not capture every historical sharing event.

To access these reports, navigate to the SharePoint admin center, select Reports in the left navigation, and review the sharing activity data. Pay attention to sites with high external sharing volumes and links that were created more than 90 days ago.

PowerShell Scripts for Deeper Audits

For a more thorough audit, PowerShell scripts using the PnP PowerShell module can enumerate sharing links across all sites, libraries, and individual files. A typical audit script connects to each site collection, retrieves the sharing links using Get-PnPFileSharingLink and Get-PnPFolderSharingLink, and exports the results to a CSV file. The output includes the link URL, the type of link (anonymous, guest, or specific people), the creation date, the expiration date (if any), and the user who created the link.

Key commands include Get-PnPSiteCollectionAdmin to identify who manages each site, Get-PnPExternalUser to list all guest accounts associated with a site collection, and Get-PnPTenantSite to iterate across all sites in the tenant. These scripts can be scheduled to run monthly and email the results to a designated administrator.

Microsoft 365 Audit Log

The unified audit log in the Microsoft Purview compliance portal records sharing events including link creation, link access, and permission changes. Searching for the activities "SharingLinkCreated" and "AnonymousLinkCreated" returns a history of when external links were generated and by whom. This log is useful for investigating specific incidents and for establishing a timeline of sharing activity on a particular file or site.

Revoking External Sharing Links

Once stale links have been identified, revoking them is straightforward.

Individual file or folder level. Open the file or folder in SharePoint, click Manage access, and review the list of active links. Delete any link that is no longer needed. For guest users, remove their access from the sharing panel or from the site's permissions page directly.

Site level. Site owners can review all sharing links for their site by navigating to Site Settings > Site permissions and reviewing external users. Removing a guest from the site revokes their access to all content within it.

Tenant level via PowerShell. For bulk revocation, PowerShell is the most efficient approach. Scripts can iterate through the CSV output from an audit, filter for links older than a specified threshold, and revoke them programmatically using Remove-PnPFileSharingLink. This is especially useful for revoking all anonymous links across the tenant in a single operation.

Azure AD guest cleanup. Revoking a sharing link does not automatically remove the guest account from Azure AD. Administrators should periodically review guest accounts in Azure AD and remove those associated with former external collaborators. The Get-AzureADUser -Filter "userType eq 'Guest'" command lists all guest accounts for review.

Governance Policies for External Sharing

Auditing and revoking links is reactive. A governance policy makes external sharing manageable before problems develop.

Set tenant-wide sharing defaults. In the SharePoint admin center under Policies > Sharing, configure the default sharing level for new sites. Restricting the default to "New and existing guests" or "Specific people" eliminates anonymous links unless a site owner explicitly overrides the setting.

Require link expiration. Configure a maximum expiration period for anonymous links and guest access links. A 30-day or 90-day expiration ensures that forgotten links do not persist indefinitely. This setting is available in the SharePoint admin center under the sharing policy configuration.

Implement approval workflows. For sensitive sites or libraries, require that external sharing requests go through an approval process. Microsoft 365 supports access request workflows where a site owner must approve each external sharing action before the link is generated. This adds friction, but for high-sensitivity content the friction is justified.

Send expiration notifications. Configure automated notifications that alert the link creator when an external sharing link is approaching its expiration date. This gives the creator an opportunity to renew the link if the collaboration is still active or to let it expire if the work is done.

Document the policy. Write down which types of external sharing are permitted, who can authorize external sharing, what expiration periods apply, and how often audits will occur. A written policy creates accountability and gives administrators a clear mandate to revoke links that violate the rules.

Review quarterly. External sharing audits should be part of a broader quarterly permissions review. Each quarter, pull the sharing reports, revoke stale links, clean up guest accounts, and verify that tenant-wide settings have not been changed. Organizations that build this into a recurring calendar event find significantly fewer surprises during compliance reviews or security incidents.

External sharing does not have to be a liability. With the right defaults, expiration policies, and a regular audit cadence, SharePoint's sharing capabilities can be used confidently without accumulating hidden risk.