When someone picks "Anyone with the link" in the Microsoft 365 sharing dialog, they create the only kind of access in the tenant that authenticates nobody. No sign-in, no recipient identity, no guest account — possession of the URL is the permission. That's occasionally exactly right, and permanently risky.
What an "Anyone" link actually grants
- Access without identity. Every other sharing shape — specific people, guests, org links — resolves to an account. An anonymous link resolves to whoever holds it: the intended supplier, the mailing list the email was forwarded to, the person who found it in a paste.
- Silent redistribution. Forwarding the link forwards the access. There is no invitation step, no acceptance, no record of the audience.
- Edit links are write access for the world. An "Anyone can edit" link on a spreadsheet is anonymous write access to business data.
- They apply to more than documents. Loop components, OneNote notebooks, Stream recordings, and Whiteboard files live in SharePoint/OneDrive as files — a file shared "Anyone" is exposed regardless of which app created it.
The settings that govern them
Administrators can disallow "Anyone" links tenant-wide or per site, force expiration days, and restrict anonymous links to view-only — all in the SharePoint admin center. Two honest observations about relying on settings alone:
- Policy is not inventory. Turning "Anyone" links off today does nothing to enumerate the links created before today, and tightening expiry typically applies to new links, not the historical tail.
- Blanket bans push behaviour sideways. If people can't share the sanctioned way, attachments and personal cloud accounts come back. A working audit-and-review loop usually beats an absolute ban.
Anonymous links vs. pending invitations
A related-but-different shape: sharing with a named external address creates an invitation that the recipient must redeem. Until acceptance, that's an unredeemed invitation — pending exposure rather than active access. A good audit distinguishes the two instead of lumping them together; TRACER365 tracks unredeemed invitations as their own (lower-severity) finding type and follows the transition when they're accepted.
Auditing them properly
TRACER365 treats every anonymous link as a HIGH-severity finding, across all SharePoint sites and every OneDrive, in one read-only scan — see the anonymous link report guide for the native alternatives and their limits. Findings carry change history: removed links resolve on the next scan and stay in the record; new ones surface at the top.
A platform footnote: Microsoft's stated policy is that Loop components can't be shared externally as Loop links. If an anonymous-link finding ever appears on a Loop file, treat it seriously — it means the content was exposed as a regular file, or something worth investigating is going on. The detection is correct either way.