Audit SharePoint Files with Public or Anonymous Sharing Links

Anonymous sharing links in SharePoint (also called "Anyone" links) allow access to files without authentication — anyone with the URL can view or edit the content. While convenient for external collaboration, these links are one of the most common sources of data leakage in Microsoft 365 tenants.

Run this audit when you need to:

• Respond to a compliance review (SOC 2, ISO 27001, HIPAA, GDPR)
• Investigate a suspected data exposure incident
• Perform a quarterly or post-acquisition data governance review
• Validate external sharing policy changes after tightening tenant-level settings
• Prepare for a tenant-to-tenant migration or M&A due diligence

The recipe walks every SharePoint site collection, enumerates each document library, inspects file-level sharing permissions, and flags items where the sharing scope is anonymous (and, optionally, organization for a broader posture review).

What you'll have when you're done

• A complete inventory of files with anonymous (public internet) sharing links across all SharePoint sites
• A secondary list of files with organization-wide links (optional but recommended)
• A CSV report with site, file path, link type, permission scope, and direct URL — suitable for import into a GRC tool or ticketing system
• Clear remediation targets: each flagged file can be revoked or re-shared with specific users
• A repeatable script you can schedule monthly to catch new exposures

Warnings and gotchas

• Read-only audit: The audit itself does not change any permissions. Never auto-revoke sharing links without a review — you may break legitimate external workflows (partners, contractors, customers).
• Throttling: Large tenants (hundreds of sites, millions of files) will hit Graph API throttling (HTTP 429). Honor Retry-After headers and paginate with @odata.nextLink.
• Permission inspection is per-item: The shared property on a driveItem only indicates that it is shared, not how. You must call GET /drives/{id}/items/{id}/permissions to confirm a link is truly anonymous.
• Nested folders: /root/children only returns top-level items. Use /root/search(q=' ') or recurse into folders to catch every file.
• OneDrive is separate: This recipe targets SharePoint sites. OneDrive personal libraries require scanning user drives via /users/{id}/drive.
• Data handling: The output report contains file paths and URLs that may themselves be sensitive. Store it in a restricted location and delete after remediation.
• Don't confuse scopes: anonymous = public internet; organization = anyone in the tenant with the link; users = specific named users. Only anonymous is a true public exposure.