Data Protection Issues

Why Can External Users See SharePoint Site Members and How to Fix It

WPS Content Manager Sep 30, 2026 868 views

Question details

External guest users granted access to a SharePoint site are able to see the names and profile information of internal site members.

Why External Users Can See SharePoint Site Members

Product: SharePoint
Device & OS: not provided
Scenario: Sharing SharePoint sites or specific documents with external guests while trying to maintain internal privacy.
Observed behavior: External users can view internal site member profiles and directory information through sharing controls, search functions, or the classic SharePoint experience.

Before you start

Ensure you have Global Administrator or SharePoint Administrator privileges in your Microsoft 365 tenant to access and modify external sharing and directory visibility settings.

Solution 1Recommended

Review Tenant-Level External Sharing and Directory Policies

Adjusting the organization's guest access and directory visibility settings in the admin center is the primary method to prevent external users from viewing internal profiles.

SharePoint’s design often exposes some user information in the sharing interface when using 'specific people' links. To prevent this, administrators must restrict guest user permissions at the tenant level so they cannot enumerate directory objects or view full profiles.

Access the Microsoft 365 Admin Center

Review SharePoint Sharing Policies

Go to Policies, select Sharing, and review the organizational-level settings for external sharing to ensure they meet your security requirements.

Adjust Guest Access in Entra ID (Azure AD)

Open the Microsoft Entra ID portal, navigate to External Identities, and select External collaboration settings. Set guest user access to the most restrictive level to prevent them from seeing directory objects and other users.

Review Tenant-Level External Sharing and Directory Policies

Solution 2

Avoid Using Anonymous Links for Confidential Data

While an anonymous link might hide certain sharing controls and member lists, it creates a severe security risk and should never be used as a workaround for privacy.

Solution 3

Escalate Unexpected Exposure to Security Teams

If you have already configured directory restrictions but external users can still see member details through search or classic experiences, the issue needs escalation.

Free Microsoft Office alternative

Securely Create and Share Documents with WPS Office

If navigating complex Microsoft Office tenant directories and SharePoint sharing controls is causing data protection concerns, consider using WPS Office. It provides a lightweight, secure, and highly compatible alternative for document creation and sharing, without exposing sensitive internal directories to guest users.

1. Download and Install WPS Office: Get the free WPS Office suite from the official website and install it on your device.
2. Create or Open Your Document: Seamlessly open your existing Microsoft Office files or create new confidential documents.
3. Share Securely: Use WPS Office's built-in, straightforward sharing tools to send files directly to external users without exposing internal organizational data.

Free and lightweight office suite with a highly familiar user interface.Fully compatible with Microsoft Office document formats (Word, Excel, PowerPoint).Simple, secure document sharing with easy-to-understand permission controls.No complex centralized tenant directories that risk exposing internal team member data.

microsoft office alternative - wps office

Frequently Asked Questions

Why do 'specific people' links expose my internal user names to guests?

This behavior is often part of SharePoint’s design for 'specific people' links, where some user information is displayed in the sharing interface so guests know who else has access to the file. To hide this, administrators must adjust tenant-level directory visibility settings in Microsoft Entra ID.

Can I use anonymous links to hide internal site members from external users?

While an anonymous ('Anyone with the link') link might bypass the specific sharing interface where names are shown, it is highly insecure. Anyone who obtains the link can access the file, making it an unacceptable workaround for confidential organizational data.

Where do I restrict guest access to my organization's directory?

Guest access restrictions are managed in the Microsoft Entra ID (formerly Azure Active Directory) admin center. Navigate to External Identities > External collaboration settings, where you can limit guest permissions to prevent them from enumerating directory objects.

Microsoft Office Security Issues