"Which of our SharePoint files can external people access?" is one of the most reasonable questions an admin gets asked — and one of the hardest to answer completely with what Microsoft gives you out of the box. Here is every native route, what each one actually shows, and where each one stops.
Method 1 — the Site Usage report
Every SharePoint site has a usage page (Settings → Site usage) with a section called Shared with external users. It's the first thing most admins find, and it looks like the answer.
It isn't, for three reasons:
- It only lists files that were shared and accessed. A file shared with an external recipient who hasn't opened it recently — arguably the exposure you most want to clean up — doesn't appear.
- It's per site. A tenant with 300 sites means 300 visits.
- It doesn't show what a guest can reach through inherited permissions — access granted on a folder or site above the file.
Method 2 — the per-site sharing report CSV
Site owners can export a sharing report — a CSV of sharing links and access on the site. It's more complete than Site Usage, but it inherits the same structural problems: one site at a time, one moment in time, and a raw row-per-item format. On a site where one folder was shared with a guest, the CSV happily lists every file under that folder as its own row — hundreds of rows describing one decision.
Method 3 — PowerShell
The genuinely complete native route is scripting: enumerate every site, walk every document library, and read every item's permissions and sharing links (the PnP cmdlets, such as Get-PnPSharingLinks, are the usual building blocks). This works. It is also:
- a real engineering task — pagination, throttling, token lifetimes, retries;
- slow on any tenant of size, and something you must re-run to stay current;
- raw output. You still have to post-process thousands of rows to separate one meaningful grant from its hundreds of inherited repetitions.
Prefer not to script it? The no-PowerShell alternative gets the same tenant-wide, deduplicated answer from a UI.
Method 4 — Data Access Governance reports
Microsoft's own answer to this question lives in the SharePoint admin center's Data Access Governance reports — but they sit behind the SharePoint Advanced Management add-on or a Microsoft 365 Copilot licence. If you have that licence, use it; if you don't, that's a per-user cost just to see your own sharing state. We wrote a separate guide to the licence wall.
What all four have in common
| Method | Complete? | Tenant-wide? | Deduplicated? | Repeatable? |
|---|---|---|---|---|
| Site Usage report | No — shared and accessed only | No — per site | No | Manual |
| Sharing report CSV | Mostly, per site | No — per site | No | Manual |
| PowerShell | Yes, if scripted well | Yes | No — raw rows | Re-run yourself |
| Data Access Governance | Broad | Yes | Partly | Yes — licence required |
The one-scan alternative
TRACER365 was built for exactly this question. One read-only scan covers every SharePoint site and every OneDrive in the tenant and surfaces external exposure as nine severity-ranked finding types: anonymous "Anyone" links, direct grants to guests, specific-people links with external recipients, pending (unredeemed) invitations, guest access arriving through group membership — and crucially, inherited guest access: files a guest can reach only because of a parent folder or site.
Then it removes the noise. Inherited duplicates collapse under the single grant that caused them — in our testing, roughly 91% of raw findings collapsed as duplicates. What's left is the list you can actually review: the ~200 findings that matter, not the 50,000 rows you'd wade through.
It's a locally installed Windows app, 100% read-only (the Azure app-registration scopes are yours to verify), needs no Copilot or Advanced Management licence, and re-scans on a schedule so the answer stays current instead of being a one-off CSV.
Honesty note: TRACER365 audits SharePoint and OneDrive file sharing. It does not audit Exchange mailboxes, Microsoft Forms, or Planner task data — the product page states exactly what it does and doesn't cover.