pH7x SystemspH7x Systems®
ExpertiseKnowledgeToolsField GuideBlogAbout
← pH7x KnowledgeSharePoint

How to read the sharing capability of a SharePoint site

What kind of external sharing does this site permit?

By João Livio·pH7x Knowledge

30-second answer

powershell
$appId = 'your Entra ID app registration id'
Connect-PnPOnline -Url https://contoso-admin.sharepoint.com `
  -Interactive -ClientId $appId
(Get-PnPTenantSite -Identity https://contoso.sharepoint.com/sites/finance).SharingCapability

Note the connection: the admin centre, not the site. Sharing capability is a tenant property about a site, not a property of the site.

What this proves

The most permissive kind of sharing this site allows:

  • Disabled : no external sharing
  • ExistingExternalUserSharingOnly : guests already in the directory
  • ExternalUserSharingOnly : new and existing guests, sign-in required
  • ExternalUserAndGuestSharing : Anyone links, no sign-in, no identity

What it does not prove

  • That anybody has actually shared anything. This is what the site permits, not what its users have done. Reading actual shares is a different, item-level question.
  • What the effective policy is when the tenant is stricter. A site can never share more than the tenant allows; the effective capability is the narrower of the two settings.

PowerShell

powershell
Get-PnPTenantSite |
  Select-Object Url, SharingCapability |
  Where-Object { $_.SharingCapability -eq 'ExternalUserAndGuestSharing' }

Do not try Get-PnPSite -Includes SharingCapability. It fails: the property is not on the site object, and the error names the valid properties. This is the single most common mistake with this setting, because the name sounds site-shaped.

Example output

text
Url                                              SharingCapability
---                                              -----------------
https://contoso.sharepoint.com/sites/finance     Disabled
https://contoso.sharepoint.com/sites/events      ExternalUserAndGuestSharing

Explanation

ExternalUserAndGuestSharing is the one that deserves attention: it permits Anyone links, and access through an Anyone link cannot be attributed to a person. Whoever holds the link is whoever the audit log will not name. The other three values all keep an identity attached to every access.

Production considerations

  • Get-PnPTenantSite requires a SharePoint administrator role and a connection to https://<tenant>-admin.sharepoint.com. A site-scoped connection cannot read it, and PnP refuses to switch context silently.
  • Enumerating all sites returns what your identity can enumerate. On a real tenant, a delegated identity saw 53 sites; an account with fewer rights sees fewer, and nothing marks the difference in the output itself.

References