Automatically Disable External Sharing on Microsoft Teams–Connected SharePoint Sites
Question details
The user wants to prevent unauthorized external sharing on SharePoint sites created automatically when Microsoft Teams teams are provisioned through Power Automate or Microsoft Graph.
- Product
- Microsoft SharePoint Online and Microsoft Teams
- Device & OS
- not provided
- Scenario
- Teams provisioning creates associated SharePoint sites, and those sites need an external-sharing restriction without manual configuration each time.
- Observed behavior
- The desired state is that newly provisioned SharePoint sites cannot share content with external users, including through Specific people links.
Sign in with a SharePoint administrator account and decide whether external sharing must be blocked across the entire organization or only on selected sites. Review existing external collaboration needs before applying a tenant-wide restriction.
Block external sharing across the SharePoint tenant
Use this option when all SharePoint sites, including newly created Teams-connected sites, must be restricted to internal users.
The organization-level SharePoint sharing setting defines the maximum sharing level allowed for its sites. Setting it to Only people in your organization prevents individual sites from enabling external sharing, regardless of whether they were created manually, through Power Automate, or through Microsoft Graph.
In the Microsoft 365 admin center, select Show all > Admin centers > SharePoint. In the SharePoint admin center, go to Policies > Sharing.
Under External sharing, move the SharePoint slider to Only people in your organization. Review the OneDrive setting as well, because OneDrive cannot be more permissive than SharePoint.
Select Save. Allow time for the change to propagate before testing a newly provisioned site.
Create a test team through your existing provisioning process. In its connected SharePoint site, select a document and choose Share, then verify that an external recipient cannot be granted access.
Automate the external-sharing restriction for selected SharePoint sites
Use a site-level automation step when some sites must remain externally shareable but newly provisioned sites need stricter settings.
Use WPS Office for everyday documents alongside your SharePoint policies
WPS Office is a free, lightweight alternative for everyday document work, with a familiar interface and Microsoft Office format compatibility for easy migration. It can help you edit files used in your organization, but it does not configure SharePoint external-sharing policies or Microsoft Teams guest access.
Frequently Asked Questions
Does disabling Anyone links stop all external sharing?
No. Depending on the allowed sharing level, users may still share with external recipients through Specific people links. To block all external sharing, go to SharePoint admin center > Policies > Sharing and set SharePoint to Only people in your organization.
Will the tenant-wide setting apply to sites created through Power Automate or Microsoft Graph?
Yes. The organization-level SharePoint sharing restriction applies regardless of how the site is provisioned. A site cannot use a more permissive external-sharing level than the tenant allows.
Can I disable external sharing on just one Teams-connected site?
Yes. In the SharePoint admin center, go to Active sites, select the connected site, and open its sharing settings. Depending on the current interface, these may appear under Settings or the command bar. Choose Only people in your organization and save, or use Set-SPOSite with -SharingCapability Disabled.
Does this also prevent guests from joining Microsoft Teams?
No. SharePoint external sharing and Teams guest access are separate controls. Review Teams admin center > Users > Guest access and the relevant Microsoft Entra and Microsoft 365 Groups settings if you also need to restrict guest participation. A guest's ability to join a team does not guarantee access to its SharePoint files.
Can a site owner enable external sharing again after it is blocked tenant-wide?
No. A site's sharing setting cannot exceed the organization-level limit. A SharePoint administrator would need to change the tenant setting in Policies > Sharing before external sharing could be enabled for a site.
