In Microsoft 365, external sharing is set at two levels: the organization and each site. If the two disagree, the stricter value applies. OneDrive can match the SharePoint setting or be tighter, never looser. Microsoft states that external sharing is on by default for the whole environment, so review it before people start using it.
Two layers, one rule
SharePoint has an organization level setting and a site level setting. To allow external sharing on any site, the organization level has to allow it. You can then restrict individual sites.
When the two values do not match, the most restrictive one wins. OneDrive follows the same logic: its setting can equal the SharePoint setting or be more restrictive.
One detail trips people up. Even when the organization level allows external sharing, not every new site allows it by default, so do not assume a new site is open or closed. Check it.
What the choices let people do
Choosing a more permissive option never takes away the tighter ones. If you allow "Anyone" links, users can still share with signed in guests and with internal users.
In plain terms, the options run from the most open (links that need no sign in) down to the most closed (only people inside your organization). The practical question for each site is whether a person without any account in your tenant should ever be able to open its content with only a link.
Guests, accounts and the Entra connection
SharePoint can use its own external authentication, or it can integrate with Microsoft Entra B2B. With B2B integration, a guest account is always created and your Entra external collaboration settings apply. Without it, sharing a file or folder does not create a guest account and the Entra settings do not apply.
That difference matters for offboarding and review. A guest account is something you can list, restrict and remove. An "Anyone" link is just a URL, so the only way to stop it is to delete the link or turn those links off for the site.
A simple site design
Microsoft's advice is direct: if you have confidential information that should not be shared externally, keep it in a site with external sharing turned off. Create separate sites for the material you do intend to share.
For a small company that usually means three kinds of sites:
- Internal only, with external sharing off. Finance, HR, source of truth documents.
- Partner or customer sites, with guests only and no "Anyone" links.
- A rare site where link sharing is allowed, with an owner who has agreed to review it.
Group connected team sites need one extra note. Group owners are site owners and group members are site members, so adding a guest to the Microsoft 365 group gives them site access. Only add guests to the group if you want that.
Stopping a share
To stop sharing with a guest, remove their permission on the item or remove them from the directory. To stop sharing with an "Anyone" link holder, delete that link or disable such links on the site. Also remember that when you share a folder with several guests, they can see each other's names in the Manage Access panel.
Safeguard's compliance and evidence automation can record the sharing setting you chose per site as audit evidence, which saves a screenshot hunt later.
Quick check
If the organization allows Anyone links but a site is set to guests only, which applies?
The site setting. The more restrictive value always applies when the two levels differ.
Does an Anyone link create a guest account?
No. It is a link that works without sign in, so you stop it by deleting the link or turning those links off for the site.
Sources
Last reviewed: 19 October 2026.
