Real Product / Anonymized: official SCOUTz Studio client-safe report capture, not a file-content audit or current customer result This is an interface illustration, not evidence of the technical condition discussed in this article.
External file sharing does not, by itself, prove Microsoft 365 data leaked. A defensible external-sharing audit separates the sharing configuration, the permission or link that exists, the sensitivity of the resource, and evidence of access or misuse.
External file sharing does not, by itself, prove Microsoft 365 data leaked. A defensible external-sharing audit separates the sharing configuration, the permission or link that exists, the sensitivity of the resource, and evidence of access or misuse.
TL;DR
- A Microsoft 365 external sharing audit distinguishes permitted collaboration from unauthorized disclosure.
- Kaseya reports 34.75% external file-sharing activity in its monitored 2025 dataset, published in 2026.
- Anyone links and authenticated guest access have different identity boundaries; review them separately.
- SCOUTz supports authorized evidence preparation without reading private files or claiming a complete content audit.
- The SCOUTz evidence methodology keeps observations, interpretations, and unknowns separate. Apply that discipline before describing a collaboration record as a breach.
Does external file sharing mean data leaked?
No. External sharing can be an approved business workflow, a misconfiguration, or part of an incident. The sharing record alone does not determine which.
| Evidence | What it establishes | What it does not establish |
|---|---|---|
| Organization permits external sharing | A configuration allows a category of sharing | A particular file was shared |
| Site permits a sharing method | A site-level option is available within the organization boundary | Every resource uses that option |
| Sharing permission or link exists | A defined access relationship exists | Someone used that access |
| External recipient authenticated | A recorded identity event occurred | The recipient was entitled to every resource |
| File access recorded | The source recorded the specified action | The access was unauthorized without further context |
| Confirmed unauthorized disclosure | Evidence supports disclosure outside the approved boundary | Every externally shared item was affected |
Best for reducing uncertainty: a scoped review combining configuration, access relationships, business authorization, and relevant activity. A large sharing count is a workload signal, not an incident conclusion.
Why this matters
Clients share documents with accountants, lawyers, suppliers, contractors, and customers. Blocking everything without understanding those relationships can interrupt legitimate work. Treating everything as acceptable because collaboration is normal creates the opposite failure.
A useful 2026 review does not choose between convenience and panic. It identifies which access is intended, which is stale or unclear, and which evidence is still needed.
The owner-facing consequence should follow the source. A link with an uncertain purpose supports asking who still needs it. It does not support announcing that confidential information has been stolen.
What Kaseya's 2026 external-sharing figures show
The 2026 SaaS Security Report describes 96,601,238 externally shared files and 181,376,929 internally shared files in its monitored 2025 dataset. The report gives the external share as 34.75%, rounded to 35% in its graphic.
The dataset spans organizations using SaaS Alerts, not all Microsoft 365 customers. Its scale makes sharing a relevant review topic; it does not make every external relationship risky or unauthorized.
A separate platform chart reports 45% external sharing for Microsoft 365 and 24% for Google Workspace, with displayed totals of 129,722,461 and 34,428,497 respectively. Those platform totals do not reconcile to the broader file-sharing total shown on the previous page. The supplied report does not explain that difference.
Therefore, do not merge those charts into a single derived platform comparison or calculate missing-platform totals as if their populations were established. Preserve the source's labels and scope. For a client assessment, use that client's own authorized records and make the denominator explicit.
The 2026 marketing sentence should not be that 35% of business data leaked. The report describes external sharing activity, not a confirmed rate of unauthorized disclosure.
Anyone links and guest access are not interchangeable
Microsoft documents several SharePoint and OneDrive external-sharing options. Anyone permits links that can be accessed without authentication; guest-sharing options require the relevant sign-in or verification process.
| Sharing approach | Best for | Review question | Limitation |
|---|---|---|---|
| Anyone link | Deliberately unauthenticated distribution where appropriate | Is unauthenticated access suitable for this resource? | Identity assurance differs from authenticated access |
| Specific people | Named collaboration partners | Are the named recipients and permissions still intended? | Naming a recipient does not establish ongoing business need |
| Existing guests | Collaboration with identities already in the directory | Are those guest relationships still approved? | Directory presence does not prove current need |
| Organization-only access | Internal collaboration | Does this match the intended audience? | Does not itself establish appropriate internal access |
Microsoft also distinguishes organization-level settings from more restrictive site settings. An organization-wide option is not a complete description of every site's effective configuration.
Do not confuse a configured default with every link users have created. Inspect the actual relationship when the review question concerns a particular resource.
Separate the four questions in an external-sharing audit
What sharing is permitted?
Review organization, site, and applicable collaboration settings within the authorized scope. Record the current configuration and date, not just the policy document describing what should happen.
A permitted sharing method is a capability. It does not prove that employees used it or that a sensitive item is accessible through it.
Preserve:
- Organization-level settings.
- Site-level restrictions.
- Relevant sharing defaults.
- Applicable expiration controls.
- Unread or unassessed locations.
- The result is a map of the configuration boundary, not a content classification result.
What access relationships exist?
Review supported permission and sharing evidence. Keep authenticated recipients, guest relationships, and unauthenticated links separate.
An inventory should preserve the resource reference, access type, available recipient information, source date, and known owner. Avoid copying private document content into a sales brief to make it look more persuasive.
If resource-level evidence is outside the review's permissions or tool coverage, state the gap. An organization-level assessment cannot silently become a complete inventory of every shared file.
Is the access approved and still needed?
Ask the business owner responsible for the collaboration. Technical records identify a relationship; business context establishes whether that relationship remains intended.
Record the answer as an attestation when that is its source. If an owner says a project ended, the statement supports a retirement review. It does not prove the permission was already removed.
Useful questions include:
- What business process needs this access?
- Who approves the recipient or audience?
- What event should end the access?
- Who verifies that access ended?
- Is the content suitable for this sharing method?
- Do not assume an old relationship is unused or a new relationship is appropriate. Age helps prioritize questions but does not answer them.
What activity or disclosure is established?
Use authorized activity sources when the question concerns what happened. Record event type, period, identity context, and coverage limitations.
No event found is not always equivalent to no access occurred. The result depends on source availability, retention, event coverage, and the access method under review.
If the evidence supports unauthorized disclosure, follow the client's incident-response process. A sales-preparation review is not a substitute for investigation, containment, legal assessment, or notification decisions.
A practical evidence-led review sequence
Start with a clearly approved boundary. Identify the tenant, sites or populations, review period, permitted evidence, recipients of the report, and responsible technical reviewer.
Then organize the work in this order:
Record the applicable sharing configuration. Identify supported access relationships within scope. Ask owners to validate purpose and intended recipients. Examine relevant activity where authorized and available. Classify each conclusion as supported, needs investigation, or not assessed. Propose specific changes through a separate approval process. Recheck the resulting condition and the business workflow after implementation. This is an assessment sequence, not permission to alter sharing settings. A broad restriction can affect suppliers, customer portals, or file-request workflows. Confirm dependencies before implementation rather than discovering them through an outage.
What a client-safe finding should say
Illustrative example, not a customer result: The authorized review observed an external-sharing relationship for a project resource. The current business owner has not confirmed whether the project still requires that access. The review did not establish unauthorized download or disclosure.
The decision is now clear: validate the project relationship and prepare an approved access change if it is no longer needed. The sentence does not accuse the recipient or imply a confirmed data leak.
Compare the alternatives:
| Wording | Problem or strength |
|---|---|
| Your company leaked these files | Unsupported without disclosure evidence |
| External sharing is secure | Too broad without scope and verification |
| An access relationship exists; business need is unconfirmed | Preserves the observation and next question |
| No sharing was found in the reviewed source | Useful only with the source and coverage limits stated |
An accurate short sentence beats an impressive but unbounded security verdict.
Where SCOUTz fits, and where it stops
SCOUTz prospect intelligence helps MSPs organize dated public observations and customer-approved Microsoft 365 evidence. For collaboration questions, SCOUTz can support preparation using the supported configuration and relationship evidence available to the review.
SCOUTz is suited to MSPs preparing evidence-led Microsoft 365 conversations, not to certifying the content of every shared file. SCOUTz does not read private documents, files, messages, or prompts. Do not describe a metadata or configuration review as if it inspected every document's sensitivity.
A separate, explicitly authorized content-governance or incident workflow may be needed. Keep that work boundary visible in the proposal so the customer knows which question the current review can answer.
SCOUTz does not autonomously change tenant configuration. The MSP and client own the decision, implementation, and operational validation. A new evidence checkpoint can show a changed observation without proving all historic access was revoked or all copied data recovered.
Common external-sharing reporting mistakes
Using sharing activity as a breach count. Approved collaboration and unauthorized disclosure are different categories.
Treating a guest inventory as a complete sharing inventory. Different collaboration methods expose different identity and link relationships. Review the actual access method rather than assuming every path requires the same guest record.
Inspecting only the organization setting. Site restrictions and resource relationships matter to the effective access question.
Declaring stale links from age alone. Validate business purpose and dependencies before proposing removal.
Reporting unread resources as clean. Missing evidence limits the conclusion. It should create a follow-up task, not disappear into a reassuring total.
Using mixed chart populations as one denominator. Kaseya's displayed platform totals and broader totals require their own scope labels. Do not repair unexplained differences with invented assumptions.
What proof belongs in the final report?
Keep the review boundary, source dates, observed configuration, access relationships, owner attestations, activity evidence, and limitations together. Restrict the evidence packet to appropriate recipients because even resource names and sharing metadata can be sensitive.
For approved changes, retain the decision and the verification record separately. One records authorization; the other establishes the observed result. Neither should be replaced by a generic completed badge.
A useful 2026 review ends with a bounded statement the client can verify. It does not end with a guarantee that external collaboration can never produce a disclosure.
Sources and scope
Kaseya, 2026 SaaS Security Report, pages 12–14 and 23. Observational data collected in 2025; broader and platform-specific sharing charts retained as separate scopes. Microsoft Learn, Manage sharing settings for SharePoint and OneDrive, updated June 30, 2026; reviewed October 14, 2026. Used for sharing-model and configuration distinctions.
FAQ
Does external file sharing prove a Microsoft 365 breach?
No. External sharing can support approved collaboration. A breach or unauthorized-disclosure conclusion requires evidence beyond the existence of sharing.
What is the difference between an Anyone link and guest access?
Anyone links permit access without authentication. Guest access uses an identity or verification relationship under the applicable sharing configuration.
Does a tenant setting show every file that was shared?
No. A configuration describes what is permitted. Resource-level permissions and activity answer different questions.
Did Kaseya find that 35% of business data leaked?
No. The report describes approximately 35% of monitored file-sharing activity as external. That is not a confirmed leakage rate.
Can SCOUTz inspect the contents of shared documents?
No. SCOUTz does not read private files or documents. Supported configuration and relationship evidence should not be described as a complete content audit.
Should an MSP remove every old sharing link?
No. Validate purpose, dependencies, and authorization before changing access. Age alone does not establish that a link is unnecessary.
One last thing
A collaboration system can be working exactly as configured and still need a business decision about who should have access. Configuration, intent, and activity belong in the same conversation, but they are not the same evidence.
To evaluate SCOUTz prospect intelligence with a real review question, Join Open Beta.
Related guides
Why SCOUTz refuses to read private files
The boundary between outside-in estimates and tenant evidence
Explore the relevant SCOUTz workflow · Review a sample report · Join Open Beta