pH7x SystemspH7x Systems®
ExpertiseKnowledgeToolsField GuideBlogAbout
← pH7x Systems KnowledgeSharing and external access

How to read what an Anyone link is allowed to do

Can somebody who was never asked to sign in change the file they opened?

By João Livio·pH7x Systems Knowledge

30-second answer

powershell
Connect-PnPOnline -Url https://contoso-admin.sharepoint.com -Interactive -ClientId $clientId
$tenant = Get-PnPTenant
$tenant.FileAnonymousLinkType     # None | View | Edit | ViewUpload
$tenant.FolderAnonymousLinkType   # None | View | Edit | ViewUpload

The product default is Edit. An unread setting is more likely to be the permissive value than the restrictive one, so an absent reading is not good news.

What this proves

What somebody holding an Anyone link may do with what it opens, separately for files and for folders. Whoever holds the link was never asked to sign in, so whatever they do afterwards is not attributable to a person.

What it does not prove

  • Whether Anyone links are used. This describes what they permit, not how many exist or who has one.
  • That the content is private. Setting the permission to View narrows what an anonymous holder can do. It does not make the file unreachable, and a link that was forwarded is still a link that was forwarded.
  • What an individual site permits. A site can be more restrictive than the organisation. This is the organisation setting.

PowerShell

powershell
$clientId = '00000000-0000-0000-0000-000000000000'
Connect-PnPOnline -Url https://contoso-admin.sharepoint.com -Interactive -ClientId $clientId

$tenant = Get-PnPTenant
[pscustomobject]@{
    Capability = $tenant.SharingCapability
    OnFiles    = $tenant.FileAnonymousLinkType
    OnFolders  = $tenant.FolderAnonymousLinkType
}

The capability comes along because it decides whether the other two matter at all: where Anyone links are not permitted, there is no anonymous permission to read.

Example output

text
Capability                  OnFiles OnFolders
----------                  ------- ---------
ExternalUserAndGuestSharing Edit    Edit

AnonymousLinkType returns one of None, View, Edit or ViewUpload. ViewUpload exists for folders and is what the Request Files feature needs.

Explanation

Two settings, and they are not the same question as whether unauthenticated sharing is allowed. That question is answered by SharingCapability. This one asks what an unauthenticated holder may do once they are in.

Microsoft states the default and the alternative in the same section: by default, Anyone links for a file allow people to edit the file, and Anyone links for a folder allow people to edit, view and upload. Both can be changed to view only, independently. Then comes the recommendation: an organisation that wants to allow unauthenticated sharing but is "concerned about unauthenticated people modifying your organization's content" should consider setting file permissions to View and folder permissions to View or View and upload.

The condition attached to that recommendation is the ordinary case, which is what makes it usable as guidance rather than as a preference.

The same page notes what following it does not cost: Specific people links still grant editing, and those require the recipient to authenticate, which makes what they did attributable afterwards.

Files and folders are deliberately different questions. Microsoft names two acceptable folder values, View and ViewUpload, because the second is what Request Files needs. A check that compared folders against a single value would report organisations that are following the guidance.

Production considerations

  • This is a read. Nothing here writes. The tenant setting is changed with a different cmdlet, which is not on this page.
  • Observed on a tenant, not only against the module: the call returns these properties and the values fall in the enum above.
  • View only is still unauthenticated read. This narrows what an anonymous holder can do; it is not a substitute for deciding what may be shared anonymously in the first place.
  • A tenant that forbids Anyone links has nothing to report here, and that is an answer rather than a gap. Treating an empty reading as a pass would be inferring success from an absence.

References