What's Shared Right Now: A Standing Sharing-Link Inventory for SharePoint and OneDrive ​

June 9, 2026 · InfraScout Team

When you assess external sharing in Microsoft 365, the hardest question to answer is also the simplest one: what is shared right now, and how dangerous is it? Event-based sources are good at telling you what changed — Defender's cloud app events and the Microsoft 365 usage reports show a share being created or accessed — but they go quiet once a share is old. A link created last year that still grants "Anyone" edit access to a sensitive document stops generating events long before it stops being a risk. With this update, InfraScout reads the current standing state of active sharing links across SharePoint Online and OneDrive for Business, so you can see live exposure rather than reconstruct it from a stream of past activity.

The live picture, not the event trail ​

InfraScout crawls drives for items that are actually shared and returns one row per active link, along with a summary you can act on. This is the exposure that matters during an external-sharing review: a standing inventory of who can reach what, assembled from the current state of your tenant rather than from a log of things that happened. A document shared anonymously in 2024 shows up the same as one shared this morning, because both are still live.

Each link is classified with the risk flags that drive an external-sharing finding:

  • Anonymous — "Anyone" links that need no sign-in and forward freely
  • No expiry — links with no end date, which quietly outlive the reason they were created
  • Edit — links that grant write access, not just view
  • External — links whose recipients are outside your organization

The default view focuses on the highest-risk combination — anonymous or never-expiring links — so the first thing you see is the exposure most likely to matter, not a wall of routine internal sharing. From there you can widen the filter when you want the full set.

Start with the riskiest links

Open an assessment and ask for the anonymous and never-expiring links across the tenant. That single question surfaces the shares that are both reachable without sign-in and have no built-in end date — the exposure an external-sharing assessment exists to find.

Point it where you want to look ​

You decide the scope of the crawl. InfraScout can sweep the whole tenant, a chosen set of sites, all of OneDrive, or a single site or drive. A broad sweep answers "where is our worst standing exposure?" across everything at once; a narrow scan answers "is this one team's site clean?" without trawling the rest of the organization.

Large-tenant sweeps page cleanly to completion. Because a full crawl can span an organization's worth of drives, results come back a page at a time — and the inventory never silently drops rows to fit. That matters when an AI client is driving the assessment: it can accumulate a complete picture across pages and know it has reached the end, instead of mistaking a truncated batch for a clean result. When a sweep is large enough to come back in parts, InfraScout says so plainly and hands back a clear pointer to continue.

A naive crawl of sharing data drowns you in noise — inherited site-membership entries, system principals, and the same propagated link repeated across every folder it touches. InfraScout filters that out so what you get back is genuine sharing, not role-based access plumbing.

External recipients are detected against your tenant's own verified domains, combined with the guest marker Microsoft 365 stamps on outside accounts, so "external" means a recipient who is genuinely outside your organization rather than a guess based on an address pattern. Inherited membership and system-level entries are dropped as noise, and links propagated across a tree are collapsed so you see one link, not one row per location. The result is an inventory you can read top to bottom and trust as real exposure.

Individual links tell you what is exposed; the tenant's sharing policy tells you what is allowed. A companion view returns the org-wide SharePoint sharing posture — the external-sharing setting, sync-app restrictions for unmanaged devices, whether legacy authentication protocols are permitted, OneDrive retention after a user is deleted, and related governance settings. Reading the standing link inventory next to the policy that governs it turns a list of risky links into a finding about why they are possible: anonymous links across the tenant land differently when the policy still allows "Anyone" sharing org-wide.

Some Anyone-link controls aren't exposed by Microsoft Graph

The policy view reflects what Microsoft Graph reports, and Graph does not expose every granular control. The settings governing anonymous-link expiration, the default link type and permission for new shares, and guest-account expiration are not available through Graph. To read or change those, use the SharePoint Online tenant admin tooling — Get-SPOTenant to inspect the current values and Set-SPOTenant to adjust them. InfraScout calls this boundary out in its own output so you don't mistake an unreported control for a disabled one.

powershell
# Inspect the Anyone-link and guest-expiration controls Graph does not surface
Get-SPOTenant | Format-List RequireAnonymousLinksExpireInDays, FileAnonymousLinkType, FolderAnonymousLinkType, DefaultSharingLinkType, DefaultLinkPermission, ExternalUserExpirationRequired, ExternalUserExpireInDays

Pull those values once with the admin tooling and you have the complete picture: the standing links from InfraScout, the org-wide posture from the policy view, and the granular Anyone-link controls from the tenant admin command.

What an administrator grants once ​

These tools are read-only and agentless — there is nothing to install on any device, and nothing in your tenant changes. To enable them, an administrator grants the Entra app registration behind the connection read access to sites, files, users, and organization information for the link inventory, plus read access to SharePoint tenant settings for the policy view. Once that consent is in place, both views are available to every assessment using that connection.

Try it ​

Open an external-sharing assessment and start broad — "show me every anonymous or never-expiring sharing link across the tenant." Narrow to a site or to OneDrive when something stands out, widen the filter to include external edit links, and pull the org-wide sharing policy to see whether the posture that allows those links is where you want it. Save what you find as insights without leaving the conversation, then close the gap on the granular controls with Get-SPOTenant.

Questions or feedback? Reach us at info@infrascout.cloud.