What it works with
Module: PnP.PowerShell
Context: PowerShell 7.4+ · SharePoint Online · PnP.PowerShell
Compatibility: PowerShell 7.4+ is required by current PnP.PowerShell releases.
POWERSHELL / SHAREPOINT
ProAdvancedRead-onlyLow
Audit external and anonymous SharePoint sharing links
Audits sharing links in selected SharePoint document libraries with a hard per-library scan limit and conservative exposure classification.
Pro generation after license validation · Review before running · No tenant access
What this PowerShell script does
Audits sharing links in selected SharePoint document libraries with a hard per-library scan limit and conservative exposure classification.
Requirements
- SharePoint site URL - Site containing the document libraries to audit.
- Entra app client ID - Your PnP app client ID. Leave empty only when a PnP default client ID is already configured.
- Library title (optional) - Leave empty to scan all visible document libraries in the selected site, or enter one exact library title.
- Include folders - When enabled, folder sharing links are checked in addition to file sharing links.
- Maximum objects per library - Hard upper bound per document library. Increase only after reviewing runtime and throttling impact.
- CSV output path - Use a new absolute Windows CSV path. Existing files are not overwritten.
Environment
- Module: PnP.PowerShell
- Runtime: PowerShell 7.4+
- Authentication: Interactive PnP with your own client ID/default
- Permissions: SharePoint AllSites.Read delegated access plus sufficient read access to the selected site and libraries.
- Risk: Low
Review before you runReview the generated PowerShell and scope before running it.
OPS / WORKSPACE
Ready to generate
Configure Audit external and anonymous SharePoint sharing links in the Builder, review the generated PowerShell and run it in your own environment.
When to use this template
Use this audit when site-level sharing settings are not enough and you need to inspect actual file and folder sharing-link metadata in a controlled scope.
Important limitations
- Anonymous links are identified from link scope. Organization-scoped links are internal to the tenant.
- Specific-people links are marked for review rather than automatically labeled external because link metadata alone does not reliably prove guest/user type.
- The report deliberately omits the sharing WebUrl/token-bearing URL; it records link identifiers and exposure metadata instead.
- The scan is limited to one selected site and bounded objects per library.
PowerShell and PnP requirements
Current PnP.PowerShell releases require PowerShell 7.4 or later. Interactive authentication requires your own Entra application/client ID, or a configured PnP default client ID. This script is read-only and does not intentionally change SharePoint configuration.
Opselith does not connect to your tenant or execute the script on your behalf. No tenant connection is required. When you generate a Pro script, only the configuration values needed for that template are sent to Opselith after license validation. Template source remains server-side.
Generate the script
- Open this template in the PowerShell Builder.
- Enter the required scope, safety and output values.
- Generate and review the PowerShell before running it in your own environment.
OPS / SCRIPT DETAILS
Script details
Audits sharing links in selected SharePoint document libraries with a hard per-library scan limit and conservative exposure classification. Review these details before generating or running the script.
Permissions and impact
Permissions: AllSites.Read
Risk: Low
Execution impact: Read-only. Enumerates bounded file/folder sharing-link metadata and does not create, remove or modify links.
Parameters
- SharePoint site URL - Site containing the document libraries to audit.
- Entra app client ID - Your PnP app client ID. Leave empty only when a PnP default client ID is already configured.
- Library title (optional) - Leave empty to scan all visible document libraries in the selected site, or enter one exact library title.
- Include folders - When enabled, folder sharing links are checked in addition to file sharing links.
- Maximum objects per library - Hard upper bound per document library. Increase only after reviewing runtime and throttling impact.
- CSV output path - Use a new absolute Windows CSV path. Existing files are not overwritten.
Output
Output: CSV sharing-link report with SiteUrl, Library, ObjectType, ObjectUrl, LinkId, LinkKind, Roles, GrantedTo, Expiration, IsAnonymous, IsExternal, ScanStatus and Error.
This template is part of the Pro library. The full Pro script is generated by Opselith after server-side license validation; only the configuration values needed by this template are sent for generation. No tenant connection is required. When you generate a Pro script, only the configuration values needed for that template are sent to Opselith after license validation.
Example use
Audits sharing links in selected SharePoint document libraries with a hard per-library scan limit and conservative exposure classification.
Enter the required values in the Builder, review the generated script and confirm the output before running it.
Before you run: Use PowerShell 7.4+ with PnP.PowerShell. Start with one library or a conservative max-object limit. Protect the CSV because it can contain file paths and recipient identity information.
Opselith quality checks
- Included in the current Opselith PowerShell quality suite
- One site only; no tenant-wide default crawl
- Hard per-library object cap
- Anonymous classification uses supported scope metadata
- Specific-people exposure remains REVIEW when external status is not provable
- Sharing URLs/tokens are not exported
Was this useful?One click. No email.