SharePoint & OneDrive Sharing Posture

The question it answers: How far can SharePoint and OneDrive content be shared - tenant sharing level, link defaults, link expiry, unmanaged devices - and which sites loosen it?

How far can content travel? The tenant-wide sharing level, what the share dialog suggests by default, whether Anyone links expire, what unmanaged devices can do - and the sites that loosen those defaults with their own settings.

Note

Site rows only appear for sites that allow Anyone links and override the tenant’s default link type or Anyone link expiry. Library-, folder- and file-level sharing is not read.

At a glance

Where in the app	SharePoint Online › Sharing & Governance › Sharing Posture
Workload	SharePoint Online
Kind	Findings list · dashboard tile
Data	Read from Microsoft 365 when someone first opens it, then kept for the report cache lifetime (Settings > Data & cache, 1 hour unless changed). It reads through PowerShell (Exchange Online or SharePoint Online), so the first load takes longer than a Graph report.
Licence	SharePoint Online.
Report id (API and MCP)	sharepoint.governance.sharing-posture

Columns

Column	Key	Type
Severity	Severity	Status
Area	Category	Text
Subject	Subject	Link
Setting	Setting	Text
Current value	Value	Text
Assessment	Finding	Text
Detail	Detail	Text
Date	When	Date
Count	Number	Number

A findings list hides columns that no row fills. Severity is Critical, Serious, Warning, OK or Info; rows rated Critical, Serious or Warning need attention (Working with findings).

What it needs

Licence: SharePoint Online.

Application permissions on the IntensiveReports app registration (all permissions):

Permission	API	What it allows	Note
Sites.FullControl.All	Office 365 SharePoint Online	Have full control of all site collections	application, certificate

Data sources it reads

• Get-PnPTenant
• Get-PnPTenantSite -Detailed

Through the API and MCP

GET /ir-api/v1/reports/sharepoint.governance.sharing-posture?size=100

An AI assistant reads it with the MCP tool get_report and the id sharepoint.governance.sharing-posture. The client needs the Read grant for SharePoint Online. See Using the API.