Discuss your project

TOOLBOX · DOWNLOAD

Sharewithoutoversharing.

In Microsoft 365, collaboration with external parties depends on settings in SharePoint, Microsoft Entra ID, Microsoft 365, and Teams. This checklist organizes them for administrators and data protection teams. It covers the terms guest access, external access, and sharing link, recommended baseline settings with their location in the admin center, and one checklist each for the organization and for every team. It also covers sensitivity labels, ongoing monitoring with reports and access reviews, and team owners and lifecycle. In addition, it includes the changes from 2025 and 2026 and the license requirement for each feature according to Microsoft Learn.

Download PDF (11 pages)What Is Inside

Free PDF · Checklist

Teams and SharePoint: Checklist for Secure Sharing

Topic
Email & Microsoft 365
Format
PDF, A4
Length
11 pages
Size
147 KB
Updated
Oct 25, 2026
Sources
28
Usage
Redistribution in unchanged form permitted
Read as a Web Page

WHO IT IS FOR

Who This
Is for.

Settings with their location in the admin center, checklists for the organization and each team, monitoring with reports and reviews, based on Microsoft Learn.

  • Administrators of Microsoft 365, SharePoint, and Teams in small and medium-sized businesses
  • Data protection and information security teams who assess and monitor sharing with external parties
  • IT managers who set rules for collaboration with customers, partners, and suppliers

8 SECTIONS

What Is
Inside.

Every technical statement in the document names its source. The revision date appears on every page.
  • 01

    What It's About: Guests, External Access, Sharing Links

    Four ways external parties get to content, the types of sharing links, and what is required by law.

  • 02

    What Changed in 2025 and 2026

    Entra B2B becomes mandatory for SharePoint, the SharePoint one-time passcode ends, guests sign in differently.

  • 03

    Baseline Settings for SharePoint and OneDrive

    The more restrictive value of organization and site applies; defaults and recommendations.

  • 04

    Baseline Settings in Entra ID and Teams

    Who may invite guests, from which domains, with MFA, and what guests and external contacts may do in Teams.

  • 05

    Checklists for the Organization and for Each Team

    Configure once in the tenant and document; check for each team and site before the first guest.

  • 06

    Sensitivity Labels for Teams, Groups, and Sites

    Container labels control privacy, guests, and sharing per team; files need their own labels.

  • 07

    Ongoing Monitoring: Reports and Reviews

    Where oversharing becomes visible, who confirms guests' need for access, and which license Microsoft lists for it.

  • 08

    Team Owners and Lifecycle

    According to Microsoft, teams need an owner to manage members; two policies help.

EXCERPT

Baseline Settings for SharePoint and OneDrive

You set the sharing level in the SharePoint admin center under Policies > Sharing, separately for SharePoint and OneDrive; OneDrive cannot be more permissive. According to Microsoft, external sharing is enabled by default. Per site (Active sites > site > Settings > More sharing settings), you can only make it stricter; the more restrictive value always applies. SharePoint administrators can change this, site owners cannot (exception: a label with a sharing setting, Section 06).

Default per site according to Microsoft: OneDrive and the root site (mandant.sharepoint.com) “Anyone”; group-connected sites, including those of Teams, “New and existing guests” if group owners are allowed to add external users, otherwise only existing guests; all others “Only people in your organization.”

Recommended baseline settings under Policies > Sharing (TOMORIS recommendation; setting names shortened)
SettingTOMORIS recommendation
External sharing for SharePoint“New and existing guests”; “Anyone” only if anonymous links are needed. Microsoft also does not recommend “Existing guests,” because guests get into the directory in other ways.
External sharing for OneDrivethe same as or stricter than SharePoint; according to Microsoft, file requests in OneDrive require “Anyone” and edit permissions for “Anyone” links
File and folder links (default link type)“Specific people,” or “Only people in your organization” if sharing is mostly internal; never “Anyone with the link”
Default permission for sharing links“View”; choose edit deliberately on a case-by-case basis
Advanced settings for Anyone linksExpiration required, for example 30 days, and “View” only; according to Microsoft, file requests require edit permissions, or “View and upload” for folders. According to Microsoft, a shorter period also applies to existing links.
Limit external sharing by domainAllow list for a fixed group of partners (up to 5,000 domains), otherwise a block list; better centrally in Entra ID (Section 04)
Allow only specific security groups to share externallyrestrict to one group for high protection needs
Allow guests to share items they don't ownoff
Guest access expires after this many dayson, matching the project duration, for example 90 days; can be set differently per site

According to Microsoft, guests usually lose access within one hour after a restriction; if sharing is turned back on, they regain it. According to Microsoft, confidential content belongs on sites without external sharing, and work with external parties belongs on separate sites.

Get the Full PDF

SOURCES

Supported
by Sources.

  1. Microsoft Learn: External sharing overview (opens in a new tab)Models, levels, guests, security; October 25, 2026
  2. Microsoft Learn: Manage sharing settings (opens in a new tab)Sharing levels, settings, Anyone links; October 25, 2026
  3. Microsoft Learn: Change the sharing settings for a site (opens in a new tab)Site level, default per site type; October 25, 2026
  4. Microsoft Learn: How shareable links work (English) (opens in a new tab)Link types; expiration of organization links only in English; October 25, 2026
  5. Microsoft Learn: Plan sharing and collaboration (opens in a new tab)Sharing levels, default permission; October 25, 2026
  6. Microsoft Learn: SharePoint and OneDrive integration with Entra B2B (opens in a new tab)2026 changeover, end of the one-time passcode, FAQ; October 25, 2026
  7. Microsoft Learn: Configure external collaboration settings (opens in a new tab)Guest access, invitations, domains; October 25, 2026
  8. Microsoft Learn: Cross-tenant access (opens in a new tab)Defaults, trust, P1 license; October 25, 2026
  9. Microsoft Learn: B2B direct connect overview (opens in a new tab)Shared channels, blocked by default; October 25, 2026
  10. Microsoft Learn: MFA for B2B guest users (opens in a new tab)Prerequisites, resource tenant; October 25, 2026
  11. Microsoft Learn: Guest access in Microsoft Teams (opens in a new tab)Guest account, invitation, licensing; October 25, 2026
  12. Microsoft Learn: Turn Teams guest access on or off (opens in a new tab)Teams admin center, features for guests; October 25, 2026
  13. Microsoft Learn: External access in Teams (opens in a new tab)Domains, unmanaged accounts; October 25, 2026
  14. Microsoft Learn: Guest access in Microsoft 365 groups (opens in a new tab)Default, org settings; October 25, 2026
  15. Microsoft Learn: Labels for groups and sites (opens in a new tab)Settings, enablement, management; October 25, 2026
  16. Microsoft Learn: Labels for groups in Entra ID (opens in a new tab)License, EnableMIPLabels; October 25, 2026
  17. Microsoft Learn: Purview service description (opens in a new tab)Labels, authentication context; October 25, 2026
  18. Microsoft Learn: Guest access with access reviews (opens in a new tab)Prerequisites, automatic removal; October 25, 2026
  19. Microsoft Learn: ID Governance, licensing for guests (opens in a new tab)Add-on, features without add-on, FAQ; October 25, 2026
  20. Microsoft Learn: Data access governance reports (opens in a new tab)Report types, frequency, E5; October 25, 2026
  21. Microsoft Learn: SharePoint Advanced Management (opens in a new tab)Prerequisites: base subscriptions, Copilot, Plan 1; October 25, 2026
  22. Microsoft Learn: Site sharing report (opens in a new tab)Running the report, CSV format; October 25, 2026
  23. Microsoft Learn: Expiration policy for groups (opens in a new tab)License, renewal, notifications; October 25, 2026
  24. Microsoft Learn: Ownerless groups and teams (opens in a new tab)Prerequisites, setup, process; October 25, 2026
  25. NISG 2026, BGBl. I No. 94/2025 (RIS) (opens in a new tab)§§ 24 to 26, 32, 51; version as of October 25, 2026
  26. NISV 2026, BGBl. II No. 290/2026 (RIS) (opens in a new tab)§§ 2 and 9; October 25, 2026
  27. Implementing Regulation (EU) 2024/2690 (opens in a new tab)Annex points 11.1, 11.2.2(d), 11.2.3
  28. GDPR, Regulation (EU) 2016/679 (opens in a new tab)Art. 32(1)(b) and (d) and (2)

This checklist is a TOMORIS recommendation and must be adapted to your own environment; it does not replace legal advice. Microsoft continually changes features, names, menus, defaults, and licenses: the linked Microsoft Learn pages in their current version are authoritative, and for obligations, the legal text of the GDPR and NISG 2026 in its current version.

TOOLBOX

Explore
Further.

EMAIL & MICROSOFT 365

More on
This Topic.

More free PDFs about Email & Microsoft 365.
All Email & Microsoft 365 Downloads

YOUR NEXT STEP

From Paper
to Practice.

We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.

Discuss ImplementationAll Downloads