Microsoft 365 External Sharing for MSPs: Multi-Tenant Review Checklist

MSP guide

An MSP can review Microsoft 365 external sharing across customer tenants only when every observation remains tenant-scoped, permission-aware, and explicit about coverage. A useful service combines configured policy, current sharing permissions, historical audit evidence where available, and a documented decision workflow. It should never merge customer data or imply complete visibility when collection is partial.

1. Define the service boundary for each customer

Record the tenant, authorized administrator, delegated relationship, approved scope, review date, and systems included. Treat SharePoint and OneDrive as related but distinct workloads. Confirm whether the review covers all sites, selected sites, personal OneDrive accounts, active users, deleted-user scenarios, or only a targeted investigation.

A multi-tenant dashboard is not proof of equal coverage. One customer may authorize tenant-wide discovery while another permits only selected sites. Keep those differences visible in every result and export.

2. Separate policy from active sharing

Organization and site settings establish what users are allowed to create. They do not enumerate every active Anyone link, Specific people link, guest permission, direct grant, or inherited permission. Capture policy as one evidence layer, then collect current permission state with a declared scope.

For historical context, Microsoft Purview audit events can show actions such as AnonymousLinkCreated, AnonymousLinkUsed, SecureLinkCreated, and AddedToSecureLink. Audit availability, retention, roles, and licensing vary; do not describe an audit search as a complete live inventory.

3. Make coverage operationally visible

For every tenant, report:

• sites and OneDrive accounts attempted, completed, partial, failed, or not authorized;
• collection start and finish time;
• permissions and data sources used;
• throttling, timeout, or API errors;
• the age of the latest successful observation;
• known exclusions and licensing-dependent gaps.

Stale or partial results should never look identical to current complete observations. This distinction is essential when an MSP compares customers or prepares evidence for an IT manager.

4. Normalize findings without flattening customer context

Use a consistent minimum record: tenant, site or OneDrive, item URL, file or folder, link or permission type, role, expiration, owner, creator where observed, external identity evidence, folder scope, and observation time. Normalize the fields, but preserve customer-specific policy, business owner, data context, and exception decisions.

Do not rank tenants only by raw link count. A small environment with anonymous edit links and unclear ownership may deserve attention before a larger tenant with controlled, authenticated collaboration.

5. Prioritize for review—not automatic disruption

Useful review factors include Anyone access, edit capability, no expiration, broad folder exposure, unexpected domains, personal OneDrive ownership, former employees, stale business ownership, and incomplete evidence. A score or label should explain its contributing factors and route the finding to a human decision.

Before remediation, identify the customer approver, business owner, expected user impact, supported Microsoft operation, rollback path, and post-change verification. Replacing or deleting a link can interrupt collaboration and change its URL.

6. Keep tenant isolation in the workflow

Use separate authorization, data partitions, exports, notifications, and audit trails for each customer. Confirm the active tenant before any change. Avoid cross-customer lists that expose document names, URLs, recipients, domains, or risk notes to the wrong operator.

7. Produce a repeatable customer review

A practical deliverable should summarize scope and coverage, explain the highest-priority findings, list owner decisions, record completed changes, and retain evidence of verification. Compare each new observation with the prior review to identify new, resolved, changed, failed, and stale items.

Start with the Microsoft 365 external-sharing review workflow, use the SharePoint audit framework for evidence design, and apply the OneDrive monitoring checklist for personal ownership and lifecycle.