'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Disable Anonymous Access to SharePoint lists.asmx Endpoint
Question details
The administrator needs to understand and restrict anonymous access to the SharePoint /_vti_bin/lists.asmx web service endpoint when external sharing is already disabled.
- Product
- Microsoft SharePoint
- Device & OS
- not provided
- Scenario
- Securing Microsoft 365 SharePoint web service endpoints against unauthorized programmatic access.
- Observed behavior
- Anonymous users may still be able to access the /_vti_bin/lists.asmx web service endpoint despite external sharing being disabled in Microsoft 365.
Ensure you have global administrator or SharePoint administrator privileges in Microsoft 365 to modify external sharing configurations and site access policies.
Restrict Site-Level External Sharing Settings
Ensure the specific SharePoint site is configured to prevent anonymous access by limiting sharing strictly to people within your organization.
The /_vti_bin/lists.asmx address is a SharePoint SOAP web service endpoint used for programmatic list access. Securing it requires properly configuring site-level sharing rules.
Log into the Microsoft 365 Admin Center and navigate to the SharePoint Admin Center.
In the left navigation pane, expand 'Sites' and click on 'Active sites'.
Locate and click on the specific SharePoint site where the lists.asmx endpoint is being accessed.
Click on the 'Sharing' tab for the selected site and set the external sharing configuration to 'Only people in your organization'.
Save your changes and allow some time for the new policy to propagate across the tenant.
Audit Tenant Policies and Anonymous Link Settings
Check broader tenant-level configurations that might be overriding site-specific restrictions or allowing legacy authentication.
Looking for a Secure and Reliable Office Suite?
While resolving complex SharePoint and Microsoft 365 administrative settings, consider WPS Office as a lightweight, secure, and cost-effective alternative for your daily document processing needs. WPS Office offers robust tools for creating and editing documents with zero administrative overhead.
- 1. Download WPS Office: Visit the official WPS Office website and click the free download button.
- 2. Install the Software: Run the lightweight installer and follow the simple on-screen instructions.
- 3. Start Creating: Open WPS Office to seamlessly edit your Microsoft Office formatted documents locally.
Frequently Asked Questions
What is the /_vti_bin/lists.asmx endpoint used for in SharePoint?
It is a legacy SOAP web service endpoint used by developers and third-party applications for programmatic access to read, create, and manage SharePoint lists and their underlying data.
Why can anonymous users access lists.asmx if external sharing is turned off?
This situation can occur if legacy authentication protocols are still enabled on the tenant, if specific site-collection features permit limited anonymous access, or if there is a conflict in tenant-level guest link policies overriding site settings.
How do I test if my SharePoint endpoint allows anonymous access?
You can test the endpoint by attempting to navigate to the site's /_vti_bin/lists.asmx URL in a private or incognito browser window where you are not logged into your Microsoft 365 account, or by using an API testing tool like Postman without passing any authentication headers.
