Skip to content
← Back to the guide

Handling an accidental external-sharing exposure

7slides. Screenshot a slide, download it as a PNG, or use your browser's Print → Save as PDF for a LinkedIn-ready multi-page carousel — each slide becomes one page.

M
solvingmicrosoft365.com
1 / 7

Handling an accidental external-sharing exposure

Runbook for a SharePoint or OneDrive folder shared with the wrong outside party: find every link and guest, cut access, establish what was opened, report.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/sharepoint-external-sharing-exposure-runbook

Slide 1Download PNG
M
solvingmicrosoft365.com
2 / 7
01

Step 1: cut the obvious access, without destroying evidence

Get the exact item: the site URL and the folder or file path. Then, as a SharePoint admin or a site collection admin:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/sharepoint-external-sharing-exposure-runbook

Slide 2Download PNG
M
solvingmicrosoft365.com
3 / 7
02

Step 2: find every path

This is the part people skip. Check all four.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/sharepoint-external-sharing-exposure-runbook

Slide 3Download PNG
M
solvingmicrosoft365.com
4 / 7
03

Step 3: establish what was actually accessed

The Unified Audit Log is where the incident becomes a set of facts. Search on the site URL for the window from link creation to now, and pull:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/sharepoint-external-sharing-exposure-runbook

Slide 4Download PNG
M
solvingmicrosoft365.com
5 / 7
04

Step 4: remove the remaining access

Now remove everything found in step 2:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/sharepoint-external-sharing-exposure-runbook

Slide 5Download PNG
M
solvingmicrosoft365.com
6 / 7
05

Step 5: decide whether it must be reported

This is not an IT decision, and the runbook's job is to give the people who decide the facts they need in one page: what was exposed (with sensitivity labels, if you use them, noted per file), to whom, for how long, whe…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/sharepoint-external-sharing-exposure-runbook

Slide 6Download PNG
M
solvingmicrosoft365.com
7 / 7
06

What to fix so it does not recur

The pattern behind almost every accidental exposure is a default that was too permissive for the site in question. Sensible corrections, in order of impact:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/sharepoint-external-sharing-exposure-runbook

Slide 7Download PNG

Auto-generated from Handling an accidental external-sharing exposure. This page is not indexed and isn't part of the guide itself.