Free tools Windows power users keep installed
One-click scans. No signup required.
You can keep external collaboration available in SharePoint without making every site or link open to anyone. Use narrower site settings, authenticated guest access, partner-domain limits, approved sharers, and time-bound links; reserve a complete sharing shutdown for content that must remain internal.
Choose controls that match the sharing risk
For SharePoint in Microsoft 365, external sharing can be governed at both the organization and site levels. The more restrictive setting takes precedence, so a permissive site setting cannot override a stricter tenant policy. Microsoft’s planning guidance recommends leaving external sharing enabled when it can be governed appropriately: Microsoft’s SharePoint and OneDrive collaboration planning guidance.
As an Amazon Associate I earn from qualifying purchases.
Think through five dimensions before changing settings: which sites are in scope, who may receive access, which employees may initiate sharing, which external domains are eligible, and how long access or links should last. These controls can be layered; the tenant’s rules constrain what individual sites can allow.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
1. Turn off external sharing only on sensitive sites
If some content must not be shared externally, disable sharing on those sites rather than shutting it off across the organization. Keep approved collaboration sites available under the organization’s broader policy. Tenant and site settings work together, with the stricter policy governing the outcome. See Microsoft’s guidance on turning external sharing on or off.
#1 Best Overall
2. Require recipients to authenticate
Choose New and existing guests when you want recipients to prove their identity rather than use an unauthenticated Anyone link. This supports collaboration with external people while making access depend on sign-in or identity verification. Microsoft describes the available sharing levels in its external-sharing settings guidance.
3. Limit sharing to guests already in your directory
Choose Existing guests only to let site users share with people who are already represented in the organization’s directory. That can include guests who accepted an earlier invitation or were added by an administrator. It prevents site users from inviting entirely new external recipients through that sharing path. The available levels are documented in Microsoft’s SharePoint sharing controls.
4. Allow or block specific partner domains
A domain allowlist limits invitations to approved partner domains; a blocklist excludes selected domains while leaving other domains eligible. Microsoft documents a maximum of 5,000 domain entries and does not allow wildcard entries. Tenant-level domain restrictions take precedence in conflicts, and a site-level allowlist must fit within the tenant allowlist. Review Microsoft Entra collaboration restrictions as well, because they can also affect sharing. Details are in Microsoft’s domain restriction guidance for SharePoint and OneDrive.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall5. Restrict which employees can share externally
Administrators can restrict external sharing to selected security groups, so only designated employees can initiate it. Those groups can be configured for authenticated guests only or for Anyone links. Anyone links are forwardable and do not let administrators track who has access or who accessed an item, so they carry a different level of exposure. Microsoft explains this control in its security-group sharing guidance.
This security-group control does not govern Microsoft 365 Groups or Teams. If your users collaborate through those services, review their related guest settings separately; Microsoft describes the relevant service settings alongside its external-sharing controls.
6. Set guest lifetimes and safer link defaults
Reduce lingering access by setting guest access expiration and intervals for verification-code reauthentication. Set defaults for link audience and permissions so users are less likely to create broader links than they need. Site-level values can differ from tenant defaults. Sensitivity labels can also configure site sharing and link behavior, depending on the organization’s configuration and applicable licensing. See Microsoft’s sharing settings guidance.
How to combine the controls
A practical policy can keep sensitive sites closed, permit authenticated guests on collaboration sites, limit new invitations to approved domains, and reserve sharing rights for designated groups. Add expiration and narrower link defaults to reduce the duration and breadth of access. Because more restrictive tenant settings constrain site choices, set the organization-wide ceiling first, then configure individual sites within it.
What happens if you disable sharing organization-wide
Turning off tenant-wide external sharing and later restoring it can allow guests to regain access. If particular sites must stay closed after sharing is restored, disable external sharing on those sites before re-enabling it at the tenant level. Microsoft says guests typically lose access within one hour when sharing is restricted or disabled. See its guidance on the effects of changing external sharing.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
