Most external exposure in Microsoft 365 arrives as a link. A direct external grant is the exception: someone wrote a permission for a specific outside person straight onto a file or folder's access list — no sharing link involved, nothing inherited from a parent. It is the plainest shape external access takes, and one of the easiest to lose track of, precisely because there is no link to go looking for.
What a direct external grant is
When you share, Microsoft 365 usually creates a sharing link — an object you can send around. A direct grant skips that: an external (guest) user is added directly to the item's permission list, the same way an internal colleague would be. The access lives on the item itself, tied to a named outside identity. That makes it distinct from the other two external shapes:
- Not a link. There is no anonymous or specific-people link to enumerate — the permission is an access-control entry, not a shareable URL.
- Not inherited. The item carries the grant on its own; it does not depend on a parent folder or site being shared. (Inherited access is the opposite case, covered in inherited guest access, explained.)
- Named and external. The grant resolves to a specific guest identity, so it is external reach you can put a name to — which is exactly why forgetting about it is easy.
Why it slips past a review
- Link reports can't see it. A sharing-link inventory lists links. A direct grant has no link, so any review built around "find the sharing links" misses it entirely.
- It looks like an ordinary permission. On the item's access list a guest sits right next to internal users. Without resolving who is external, the one entry that reaches outside your organisation is indistinguishable from the ones that don't.
- OneDrive is where they concentrate. On personal OneDrive, direct external grants are frequently the dominant shape of external access — and native tooling is per-user, so nobody is looking across every drive at once. The OneDrive external sharing report guide walks that blind spot in full.
- The permission level can climb quietly. Read access today can become edit access next month — a change to the same grant, not a new share, and therefore invisible to a one-time snapshot.
How TRACER365 surfaces it
TRACER365 emits direct external grants as their own MEDIUM-severity finding type, across every SharePoint site and every OneDrive in a single read-only scan — no per-user hunting. Each external principal on the grant is recorded individually, and both recipient-set expansion and permission-level escalation are tracked over time, so a read-to-edit change or an added guest shows up as a change rather than sinking back into the noise. When the grant is removed, the finding resolves on the next scan and stays in the history.
Severity sits at MEDIUM for a reason: a direct grant reaches one named person, not the public. That is a step below an anonymous link, which authenticates nobody — see anonymous sharing links, explained for why those rank HIGH. Where a direct grant differs from the noisy end of the spectrum is volume: inherited access repeats one parent grant across every child item (in our testing, roughly 91% of raw findings collapsed as duplicates, most of them that pattern), whereas a direct grant is usually one permission on one item — so it reviews cleanly instead of burying you.
Direct grant vs. the other external shapes
- vs. a sharing link. A link is a shareable object — anonymous or scoped to specific people. A direct grant is a named guest on the access list, with nothing to forward.
- vs. inherited access. Inherited access means the item has no permission of its own and the reach comes from above it. A direct grant is written on the item itself.
What to do about it
- Inventory direct external grants alongside links and inherited access, not instead of them — the complete how-to covers all three in one pass.
- Review the person, not just the file: is this guest someone who should still reach it?
- Re-scan on a schedule — permission levels drift and new guests get added silently.