An anonymous link — "Anyone with the link can view/edit" — is the sharpest edge in Microsoft 365 sharing: no sign-in, no identity, no way to know who is holding it. If your organisation allows them at all, you need a complete inventory. Here's how to get one, and why the native routes fall short.
Why "Anyone" links deserve their own report
- No identity. Every other sharing shape names a recipient. An anonymous link authenticates nobody — whoever holds the URL has access, including anyone it was forwarded to.
- They travel. Email threads, chat messages, ticketing systems. The link's audience is unknowable by design.
- They outlive their purpose unless an expiration was set — and expiration policies came later than most tenants' oldest links.
For the deeper explainer — what these links are, tenant settings that govern them, expiry options — see anonymous sharing links, explained.
The native routes
Tenant and site sharing settings
The SharePoint admin center shows whether "Anyone" links are allowed — per tenant and per site. That's policy, not inventory: it tells you nothing about the links that already exist.
Per-site sharing reports
A site's sharing report CSV includes its sharing links. To inventory anonymous links tenant-wide you'd export and filter it for every site and every OneDrive, then repeat next quarter. It's point-in-time, per-site, and raw.
PowerShell
Scripts walking every item's sharing links (Get-PnPSharingLinks and friends) can filter for scope = anonymous — the complete route, at the usual cost: real scripting, throttling, re-runs, raw output.
The complete, ranked answer
TRACER365 detects every anonymous link across all SharePoint sites and all OneDrives in one read-only scan, and treats them as what they are: HIGH-severity findings, surfaced at the top of the list rather than buried in rows. Because Loop components, OneNote notebooks, Stream videos, and Whiteboard files are stored in SharePoint and OneDrive, an "Anyone" link on any of them is caught by the same detection.
Beyond the inventory itself:
- Change tracking. A resolved link stays resolved in the history; a new one is a new finding. Your review effort accumulates instead of resetting with every CSV.
- De-duplication. Findings inherited by child items collapse under their cause — in our testing roughly 91% of raw findings collapsed as duplicates.
- A report a non-admin can read. Scheduled email reports and a viewer role mean the "who approved this?" conversation can include the business owner.