Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000212

SharePoint Online tenant with external sharing set to 'Anyone'

High
SharePoint
Collection Exfiltration

Signature Identity

CTD-000212
Threat ID
Version
IOE
Indicator Type

Threat Description

A SharePoint Online tenant that allows external sharing at the Anyone level is a vulnerability, because it permits anonymous, unauthenticated links to files and folders that require no sign-in. A threat actor, or an insider acting carelessly or maliciously, exploits this by sharing a link that anyone who obtains the URL can open. Your organization can’t verify who used the link, and can’t revoke access for a specific identity afterward. Restricting external sharing to New and existing guests or a more limited level mitigates this exposure, because it ties access to a verifiable identity and reduces the effect of a leaked link.

For example, an employee shares a folder of customer contracts through an Anyone link intended for a single partner. The link is forwarded, indexed by a search engine, or intercepted, and the contracts become available to anyone who has the URL. No sign-in is required, and no record shows who viewed the content. Restricting the tenant-wide sharing level prevents Anyone links from being created at all.

MITRE ATT&CK: Attack Tactics

Collection Exfiltration

D3FEND: Defend Tactics

D3-ACH (Application Configuration Hardening)

Remediation

In the SharePoint admin center, set the organization-level external sharing level for SharePoint and OneDrive to New and existing guests or a more restrictive level.

  1. Sign in to the SharePoint admin center.
  2. Expand Policies, and then select Sharing.
  3. Under External sharing, move the SharePoint slider to New and existing guests or a more restrictive level.
  4. Move the OneDrive slider to the same level or a more restrictive one.
  5. Expand More external sharing settings, and then select the additional restrictions that your organization requires.
  6. Select Save.

Note: These settings apply to your organization overall. The SharePoint setting covers all site types, including sites connected to Microsoft 365 groups and to teams, and the guest sharing settings for groups and Teams also affect the connected SharePoint sites. The OneDrive setting can be more restrictive than the SharePoint setting, but not more permissive. Each site has its own sharing setting that you can set independently, as long as it’s the same as the organization-level setting or more restrictive.

More information: Turn external sharing on or off for SharePoint

Frequently Asked Questions

What does SharePoint Online tenant with external sharing set to 'Anyone' mean?

A SharePoint Online tenant with external sharing set to 'Anyone' allows anonymous access to files and folders via unauthenticated links, bypassing sign-in requirements and increasing the risk of unauthorized access. This setting enables anyone with the URL to access files and folders without sign-in, making it challenging for administrators to track and revoke access.

This setting increases the risk of data exfiltration and unauthorized sharing due to the lack of authentication and authorization controls. Attackers can exploit this vulnerability to gain unauthorized access to sensitive data.

Attackers can share a link that allows anyone with the URL to access sensitive data without sign-in, exploiting the lack of authentication and authorization controls to gain unauthorized access. This can lead to data exfiltration and unauthorized sharing.

Cayosoft Guardian continuously monitors for SharePoint Online tenant with external sharing set to 'Anyone' and alerts administrators when the condition is detected. This provides visibility into the exposure so security teams can review the finding and determine whether investigation or response is required. Guardian monitors SharePoint for this condition and flags it when detected.

Cayosoft Guardian helps reduce the risk of SharePoint Online tenant with external sharing set to 'Anyone' by alerting administrators when the condition is detected and providing visibility into the affected objects, accounts, policies, or permissions. This helps security teams identify exposure more quickly and respond before the issue contributes to a larger security event.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
SharePoint
Themes
Data protection
Attack Tactics
Collection Exfiltration
Defend Tactics
D3-ACH (Application Configuration Hardening)
Indicator Types
IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical