30-second answer

PowerShell
$appId = 'your Entra ID app registration id'
Connect-PnPOnline -Url https://contoso-admin.sharepoint.com `
  -Interactive -ClientId $appId
(Get-PnPTenantSite -Identity https://contoso.sharepoint.com/sites/finance).SharingCapability

Note the connection: the admin centre, not the site. Sharing capability is a tenant property about a site, not a property of the site.

What this proves

The most permissive kind of sharing this site allows:

  • Disabled : no external sharing
  • ExistingExternalUserSharingOnly : guests already in the directory
  • ExternalUserSharingOnly : new and existing guests, sign-in required
  • ExternalUserAndGuestSharing : Anyone links, no sign-in, no identity

What it does not prove

  • That anybody has actually shared anything. This is what the site permits, not what its users have done. Reading actual shares is a different, item-level question.
  • What the effective policy is when the tenant is stricter. A site can never share more than the tenant allows; the effective capability is the narrower of the two settings.

PowerShell

PowerShell
Get-PnPTenantSite -Identity https://contoso.sharepoint.com/sites/finance |
  Select-Object Url, SharingCapability

One site, named. -Identity is the evidence path, and the reason is not style.

Do not read this property from a bulk enumeration. Get-PnPTenantSite without -Identity does not populate every attribute: the cmdlet's own documentation says that without -Detailed, "some attributes will show default values that may not be correct". A filtered list therefore answers a different question: which sites matched what the list happened to contain. A site missing from the output is indistinguishable from a site whose value was never populated, which is a false negative wearing the shape of a clean result.

If you need the whole tenant, enumerate to get the list of URLs and then read each site by identity, which is what the engine's collector does.

Do not try Get-PnPSite -Includes SharingCapability either. It fails: the property is not on the site object, and the error names the valid properties. This is the single most common mistake with this setting, because the name sounds site-shaped.

Example output

Text
Url                                              SharingCapability
---                                              -----------------
https://contoso.sharepoint.com/sites/finance     Disabled

Explanation

ExternalUserAndGuestSharing is the one that deserves attention: it permits Anyone links, and access through an Anyone link cannot be attributed to a person. Whoever holds the link is whoever the audit log will not name. The other three values all keep an identity attached to every access.

There are two ways to read this property, and they disagree in the worst possible way: silently, with a valid-looking value. Microsoft documents that filtered site enumeration does not populate 22 properties of the site object, SharingCapability among them; an unpopulated enum prints its zero, and the zero of this enum is Disabled. PnP's enumeration calls the same filter-based admin API; the per-site -Identity read does not. The governance engine's sandbox run reproduced the trap on 1 of 5 sites: enumeration said Disabled for a site whose direct read said ExternalUserAndGuestSharing. A site permitting guest sharing, reported as locked down, by a correct API returning a default.

The engine's answer is structural, not procedural: the enumerated site.sharing_capability is recorded as not-supported and nothing is allowed to read it, so no rule can ever be built on the value that lies. The collection-path audit states the standing rule: never build a rule on a property until the collection path is proven to populate it.

Production considerations

  • Get-PnPTenantSite requires a SharePoint administrator role and a connection to https://<tenant>-admin.sharepoint.com. A site-scoped connection cannot read it, and PnP refuses to switch context silently.
  • Enumerating all sites returns what your identity can enumerate. On a real tenant, a delegated identity saw 53 sites; an account with fewer rights sees fewer, and nothing marks the difference in the output itself.
  • SPO-SHARE-001: a site that allows Anyone links permits access that cannot be attributed

References

Found something wrong? Suggest a correction. The article source is not public; the engine it cites is.

What this answer underwrites

The engine reads these Microsoft operations to collect evidence, so what is established here is what those collectors rest on.

  • activitywhen a person last changed something on one site
  • classificationwhat a site records about the kind of content it holds
  • sharingwhat one site permits, and its default link
  • sitesevery site this identity can enumerate