What it works with
Module: PnP.PowerShell
Context: PowerShell 7.4+ · SharePoint Online · PnP.PowerShell
Compatibility: PowerShell 7.4+ is required by current PnP.PowerShell releases.
POWERSHELL / SHAREPOINT
FreeBeginnerRead-onlylow
Find SharePoint sites that allow external sharing
Finds sites whose effective sharing capability permits external users or anonymous links and explains the matched state.
Generated locally in your browser · Runs in your PowerShell environment · Review before running
What this PowerShell script does
Finds sites whose effective sharing capability permits external users or anonymous links and explains the matched state.
Requirements
- SharePoint admin URL - Example: https://contoso-admin.sharepoint.com
- Entra app client ID - Your PnP app client ID. Leave empty only when a PnP default client ID is already configured.
- Include existing-guests-only sites - Include ExistingExternalUserSharingOnly sites. Disable to focus on sites that allow new external users or anonymous links.
- CSV output path - Use a new absolute Windows CSV path.
Environment
- Module: PnP.PowerShell
- Runtime: PowerShell 7.4+
- Authentication: Interactive PnP login with your own Entra app/client ID or configured default
- Permissions: SharePoint AllSites.Read delegated access + SharePoint Administrator role / tenant-admin-site access.
- Risk: Low
Review before you run The generated script is read-only, but authentication and access requirements still apply in your tenant.
OPS / WORKSPACE
Ready to generate
Configure Find SharePoint sites that allow external sharing in the Builder, review the generated PowerShell and run it in your own environment.
When to use this template
Filters site sharing capability without crawling files or links. You can include sites restricted to existing directory guests or focus on sites that allow new external users/anonymous links.
Important limitations
- A permissive SharingCapability does not prove that the site currently has external users or active sharing links.
- Actual anonymous/external link enumeration belongs to the later deep sharing-link audit.
- OneDrive personal sites are excluded from this SharePoint-site report.
PowerShell and PnP requirements
Current PnP.PowerShell releases require PowerShell 7.4 or later. Interactive authentication requires your own Entra application/client ID, or a default client ID that you have configured for PnP.PowerShell. Opselith does not connect to SharePoint or run the script on your behalf.
Generate the script
- Open the template in the PowerShell Builder.
- Enter the requested URLs, client ID (when needed) and a new CSV output path.
- Generate the script, review its permissions and commands, then run it in your own PowerShell environment.
OPS / SCRIPT DETAILS
Script details
Finds sites whose effective sharing capability permits external users or anonymous links and explains the matched state. Review these details before generating or running the script.
Permissions and impact
Permissions: AllSites.Read · SharePoint Administrator
Risk: Low
Execution impact: Read-only. The script filters SharePoint tenant site metadata and does not alter external-sharing configuration or sharing links.
Parameters
- SharePoint admin URL - Example: https://contoso-admin.sharepoint.com
- Entra app client ID - Your PnP app client ID. Leave empty only when a PnP default client ID is already configured.
- Include existing-guests-only sites - Include ExistingExternalUserSharingOnly sites. Disable to focus on sites that allow new external users or anonymous links.
- CSV output path - Use a new absolute Windows CSV path.
Output
Output: CSV report with SiteUrl, Title, SharingCapability, AllowsNewExternalUsers, AllowsAnonymousLinks, GroupConnected and Owner.
This template is available in the free library and is generated locally in your browser.
Example use
Finds sites whose effective sharing capability permits external users or anonymous links and explains the matched state.
Enter the required values in the Builder, review the generated script and confirm the output before running it.
Before you run: Use PowerShell 7.4+ with PnP.PowerShell and SharePoint Administrator access. The result is based on the effective SharingCapability value returned for each site; it does not prove that a site currently has active external users or links.
Opselith quality checks
- Included in the current Opselith PowerShell quality suite
- Current PnP.PowerShell runtime and interactive-auth requirements documented
- Read-only behavior and minimum permissions documented
- Stable CSV column order and explicit zero-result behavior
- Review-before-run guidance provided
- No artificial pacing inside SharePoint enumeration loops
Was this useful?One click. No email.