---
title: Tips for administrators- how to manage Microsoft 365 external sharing
description: Our experts' advice to improve the management of external sharing, essential to ensure data security
image: https://blog.idecsi.com/hubfs/Blog%20Images/BLOG-PARTAGES-EXTERNES_ADMIN.png
---
[](https://www.idecsi.com/)
- Solutions
DETOX® pour M365
Audit, Remediation & ROI
[Discover DETOX](https://info.idecsi.com/detox-m365?hsLang=en)
Solutions
IDECSI gives security and IT teams full control over their data — across DSPM, Data Access Governance, Human Risk Management, and Data Volume Management.
- [ M365 Data Security Platform](https://www.idecsi.com/solution/mydatasecurity/)
- [ Data storage optimization](https://www.idecsi.com/solution/mydatamanagement/)
- Challenges
M365 Checklist
15 Warning Signs Your M365 Data Is at Risk
[Get the checklist](https://info.idecsi.com/checklist-15-warningsigns?hsLang=en)
Your 2026 Challenges
Address your most critical data security and governance challenges - across your M365 environment
- [ Gain visibility accross M365](https://www.idecsi.com/challenges/visibility-microsoft-365)
- [ Get Ready For Copilot M365](https://www.idecsi.com/challenges/m365-copilot/)
- [ Control external user access](https://www.idecsi.com/challenges/external-access-microsoft-365/)
- [ Prevent Sensitive Data Exposure](https://www.idecsi.com/challenges/sensitive-data-m365/)
- [ Gain visibility across Microsoft 365](https://www.idecsi.com/challenges/visibility-microsoft-365/)
- [ Ensure regulatory compliance](https://www.idecsi.com/challenges/compliance-m365/)
- Resources
Is Your Tenant Ready for Copilot?
A Security & Governance Playbook
[Download](https://info.idecsi.com/whitepapper_copilot?hsLang=en)
Our resources
Check out our useful resources for improving data protection
- [ Blog](https://blog.idecsi.com)
- [ Help Center](https://help.idecsi.com/)
- [ Ressources & News](https://blog.idecsi.com/resources?hsLang=en)
- [ About us](https://www.idecsi.com/about-us/)
- [Customers](https://blog.idecsi.com/resources-customer?hsLang=en)
- - [English](https://blog.idecsi.com/tips-admins-external-sharing-microsoft365)
- [Français](https://blog.idecsi.com/fr/conseils-gerer-partages-externes-microsoft365)
Search
[Request a demo](https://info.idecsi.com/demo-idecsi?hsLang=en)
Microsoft 365
22 February 2023
# Tips for administrators: how to manage Microsoft 365 external sharing
- [Home](https://www.idecsi.com/)
- [Blog](https://blog.idecsi.com)
- Tips for administrators: how to manage Microsoft 365 external sharing
Microsoft 365 allows users to share documents or invite people outside the organization into collaboration groups. These external users are by default named guests in the Microsoft 365 environment.
This ease of external collaboration drives the need for improved access and sharing management in Microsoft 365.
Only 64% of IT teams have a way to control sharing with people outside the company – Microsoft 365 study from 2021.
However, managing external access and the data lifecycle is essential to ensuring data security: detecting external sharing links, making sure they are compliant and correcting them if necessary.
In this context, administrators or security teams have a role to play.
- [Advice on setting up the environment and external sharing](https://blog.idecsi.com/tips-admins-external-sharing-microsoft365#conseils)
- [Data governance and access review in Microsoft 365](https://blog.idecsi.com/tips-admins-external-sharing-microsoft365#gouvernance)
## Advice on setting up the environment and external sharing
Firstly, it is not recommended to close shares with external parties, as this can lead to the rise of shadow IT solutions.
However, setting up guests and external shares by administrators remains an important and proactive approach to mitigating vulnerabilities, even when a patch is not yet available. This will enable the application of protective barriers to secure the company’s content.
### Best practices for setting up the entire tenant
- Limit guest access policy
Instead of disabling guest access to the tenant, Microsoft 365 administrators can restrict them. Via PowerShell, they can prevent a guest from accessing specific groups or block guests from a specific domain.
- Set up a multi-factor authentication for external users
The identities of external guests can be impersonated. Implementing multi-factor authentication allows the user’s identity to be verified on another device and reduces the risk of compromise.
- Set session expiration times
For an enhanced identity policy, in addition to multi-factor authentication, you can enable a session timeout. Guests will need to log in regularly to access their account. This verifies the security of the device and the identity of the accessor.
- Implement DLP policies on privacy tags
Using privacy labels from Microsoft Purview Information Protection and the Azure AD DLP tool, policies can be defined to track and control sensitive data.
IDECSI completes Microsoft’s offer by integrating Purview’s classification labels and by proposing an advanced monitoring platform to supervise and be alerted in case of overexposure or compromise.
[Sensitive Data in Microsoft 365: How to Identify Risks and Regain Control](https://blog.idecsi.com/fr/sensitive-data-microsoft-365?hsLang=en)
### Best practices for setting up sharing links
In Microsoft 365, share management is done through share links, of which there are several: Anonymous (everyone), Whole Company, Specific User.
In this case, where anonymous sharing is still allowed, admin teams can set up additional settings to reduce the risks.
- Set default link type
When a user decides to share a document or folder via OneDrive or SharePoint, the Anonymous link applies by default, when active in the organization.
If the user does not change the default link, he will unintentionally create an anonymous link that can be accessed by anyone without the need for authentication.
Administrators can set the default link to “Whole Company” or “Specific Person”.
- Set an expiration date for “Anonymous” links
Some data stored on SharePoint, Microsoft Teams or OneDrive will be kept.
By imposing an expiration date for Anonymous links, guest access will be automatically reviewed without user intervention. This prevents unexpected accesses over time and unwanted changes.
- Set permissions for Anonymous links
There are several possible permissions for Microsoft share links: edit, read, download.
By default, links are set to “Edit” but admin teams can push a read-only permission by default. Thus, guests will not be able to modify the content of the shared document.
### Raising user awareness
The best practice for managing external shares is still user awareness.
Users are now the administrators of their resources. Moreover, the creation of a share starts with them via the creation of a share link, the creation of a teams team or a SharePoint site.
This is why, today, employee awareness of security issues is essential to prevent the risk of data leakage.
[](https://www.idecsi.com/solution/mydatasecurity/)
## Data governance and access review in Microsoft 365
Enabling external shares carries risks (data leakage, no control over shares, illegitimacy of sharing over time). It is recommended that governance rules be put in place to reduce these risks.
Visibility is the core of this governance strategy. Native Microsoft and third-party solutions exist to understand how data is used and to monitor access.
Following the audit of the environment, it is possible to apply an access rights review strategy. Access review over time ensures that the rights granted to users are consistent with an organization’s security policy and the user’s activity.
Watch out the video to discore how to improve data sharing governance for Microsoft Teams
### Microsoft Access Reviews
Azure AD Access Reviews is Microsoft’s tool for tracking and managing internal group membership and therefore access. By launching access review campaigns, it is possible to send notifications to Teams or SharePoint group owners to validate members.
Azure AD Access Reviews allows you to involve users in access reviews and ensure regular review of access made to resources.
Following the launch of the campaign, the owners of the Teams / SharePoint groups will receive an email with the group to be checked. The verification will be carried out at member level only and will not affect shared channels.
Permissions or sharing links made outside of a Teams team (on SharePoint for example) will not be part of the recertification campaign.
This tool is only offered in the Azure AD P2 license (included in the Microsoft E5 license).
### The IDECSI complement
IDECSI has developed a recertification tool, which completes the Microsoft offer by addressing all Microsoft 365 collaborative tools, regardless of the license level.
To do this, security teams and administrators have a solution to quickly launch audits and quickly see at-risk shares (external, anonymous) and overexposure of data on the tenant.
Administrators can then launch automated and programmable rights review campaigns:
- Duration, periodicity
- Automatic reminders
- Email and notification customization
- Targeting resources and populations
Customized reports are then available on the platform to analyze the results of ongoing campaigns (tracking requests, validations, planning).
The user has a security dashboard to set up governance over his data and a review of the shares from a single portal, named [MyDataSecurity](https://www.idecsi.com/solution/mydatasecurity/).
In the context of a campaign, users will also receive a notification to recertify all permissions and will be able to apply automatic troubleshooting.
#### \[Case Study - SNCF\]
#### Scaling the process of recertification for SharePoint sites
[](https://cta-redirect.hubspot.com/cta/redirect/4272098/f93e1126-a845-40c4-b31a-7a1f693276d0)
Recent articles
[Sensitive Data in Microsoft 365: How to Identify Risks and Regain Control](https://blog.idecsi.com/fr/sensitive-data-microsoft-365?hsLang=en)
[Microsoft 365 SharePoint Storage Costs in 2026: What's Changing](https://blog.idecsi.com/microsoft-365-sharepoint-storage-costs-2026?hsLang=en)
[Zero Trust Data Governance for Microsoft 365: CISO Guide](https://blog.idecsi.com/zero-trust-data-governance-microsoft-365?hsLang=en)
[Cybersecurity Awareness Month: A CISO's M365 Action Plan](https://blog.idecsi.com/cybersecurity-awareness-month-ciso-action-plan-m365?hsLang=en)
Best practices to improve Microsoft Teams security
[](https://cta-redirect.hubspot.com/cta/redirect/4272098/825ad7d1-e961-4a7a-a6b3-6e380b22285f)
Share this article
Subscribe to our newsletter and receive new contents every month
Our articles
These articles may
interest you
Microsoft 365
Microsoft 365 SharePoint Storage Costs in 2026: What's Changing
[Lire l'article](https://blog.idecsi.com/microsoft-365-sharepoint-storage-costs-2026?hsLang=en)
Microsoft 365
Security
Microsoft Foundry: Complete Guide and Data Security Implications (2026)
[Lire l'article](https://blog.idecsi.com/microsoft-foundry-guide-security?hsLang=en)
Microsoft 365
Security
Microsoft 365 Phishing: Why Oversharing Makes a Compromised Account Far More Dangerous
[Lire l'article](https://blog.idecsi.com/fr/phishing-microsoft-365-risques-donnees-partagees-1?hsLang=en)
Microsoft 365
Security
Securing AI Agents in Microsoft 365: Best Practices for 2026
[Lire l'article](https://blog.idecsi.com/securing-ai-agents-microsoft-365?hsLang=en)
### Data protection, let's discuss your project?
[](https://cta-redirect.hubspot.com/cta/redirect/4272098/bea4f372-c84f-4ec4-980c-ca663747fbfe)
[](https://www.idecsi.com/)
+33 1 84 79 38 30
-
-
-
- [Why choose IDECSI?](https://www.idecsi.com/user-security/)
- [About us](https://www.idecsi.com/about-us/)
- [Join the team](https://www.welcometothejungle.com/fr/companies/idecsi)
- Solutions
- [Visibility](https://www.idecsi.com/challenge-data-visibility/)
- [Detection](https://www.idecsi.com/challenge-threat-detection/)
- [User engagement](https://www.idecsi.com/challenge-involve-user/)
- [Access review](https://www.idecsi.com/challenge-rights-review/)
- [Remediation](https://www.idecsi.com/challenge-remediation/)
- [Sensitive data](https://www.idecsi.com/challenge-sensitive-data/)
- [Products](https://www.idecsi.com/solution/)
- [MyDataSecurity](https://www.idecsi.com/solution/mydatasecurity/)
- [Advanced Monitoring](https://www.idecsi.com/solution/advanced-monitoring/)
- [MyDataManagement](https://www.idecsi.com/solution/mydatamanagement/)
- Resources
- [Resources & News](https://blog.idecsi.com/resources?hsLang=en)
- [Blog](https://blog.idecsi.com)
- [Customer success](https://blog.idecsi.com/resources-customer?hsLang=en)
- [Extranet](https://extranet.idecsi.com?hsLang=en)
© IDECSI
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Caroline Bourgoin",
"url" : "https://blog.idecsi.com/author/caroline-b"
},
"dateModified" : "2026-10-05T12:43:19.339Z",
"datePublished" : "2023-02-22T15:46:00.000Z",
"headline" : "Tips for administrators- how to manage Microsoft 365 external sharing",
"image" : [ "https://blog.idecsi.com/hubfs/Blog%20Images/BLOG-PARTAGES-EXTERNES_ADMIN.png" ],
"mainEntityOfPage" : {
"@id" : "https://blog.idecsi.com/tips-admins-external-sharing-microsoft365",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.idecsi.com/hubfs/Logo-Idecsi-Black-tagline.png"
},
"name" : "IDECSI"
}
}
```
```json
{
"@context" : "https://schema.org",
"@type" : "VideoObject",
"contentUrl" : "https://4272098.fs1.hubspotusercontent-na1.net/hubfs/4272098/MyDataSecurity%20pour%20Microsoft%20Teams.mp4",
"dateModified" : "2023-10-24T15:22:04.872Z",
"description" : "Vidéo de présentation Plateforme MyDataSecurity pour Microsoft Teams",
"duration" : "PT59.903S",
"height" : 1080,
"name" : "Vidéo de présentation de la plateforme MyDataSecurity pour Microsoft Teams",
"thumbnailUrl" : "https://4272098.fs1.hubspotusercontent-na1.net/hubfs/4272098/MyDataSecurity%20pour%20Microsoft%20Teams.mp4/medium.jpg",
"uploadDate" : "2023-10-23T13:51:53.628Z",
"width" : 1920
}
```