MELTr
Home Vendors Search Download
Login
Vendors / Microsoft Corporation / Office 365 / SharePoint Anonymous Link Created
Microsoft Corporation logo

Event type

SharePoint Anonymous Link Created

Public File Sharing - Data Exposure Risk

Records SharePoint Online anonymous link creation events where users create publicly accessible sharing links for files or folders, enabling external access without authentication

JSON 35 fields Medium Generator

sharepoint external-sharing anonymous-access data-exposure collaboration
Preview Sample View Schema
CLI Install
meltr templates install microsoft

Overview

What this event covers

Captures SharePoint Online events where users create anonymous sharing links ('Anyone with the link') for files or folders. These links allow unauthenticated access to content, creating potential data exposure risks, especially for sensitive documents in Finance, HR, or Legal sites.

When generated

  • ›User shares a file or folder via 'Anyone with the link' option
  • ›Anonymous sharing link created for collaboration with external partners
  • ›Accidental oversharing of confidential documents
  • ›Attacker with compromised account creates links for data exfiltration
  • ›Legitimate business sharing for public content

Security relevance

Medium

Compliance

GDPR (Data Protection & Transfer) HIPAA (PHI Sharing Controls) PCI-DSS (Cardholder Data Protection) SOX (Financial Data Controls) NIST 800-53 (AC-3, AC-6, SC-7)

Frequency notes

Medium-high frequency in knowledge worker environments (15 events/hour baseline). Business hours show 3x activity as users actively collaborate. Suspicious patterns: anonymous links to Finance/HR/Legal sites, very long expiration dates (30+ days), Edit permissions (vs View-only), and links created outside business hours for sensitive content.

Resources

Docs and tools

Office 365 Management Activity API Schema official SharePoint Online External Sharing Overview official Manage Sharing Settings official MITRE ATT&CK - Data from Cloud Storage (T1530) reference Microsoft 365 Defender Native detection for suspicious SharePoint sharing activities SharePoint Admin Center Configure external sharing policies and audit sharing links Microsoft Cloud App Security Monitor and control SharePoint sharing with DLP policies

Generation

Configuration

Base frequency
15 events/hour
Time patterns
business_hours night_hours
Business hours
3.0x
Night hours
1.5x
Weekend
0.8x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

CreationTime
DateTime Required

Timestamp when the anonymous link was created

Source: now() | iso8601

Format ISO 8601
Example 2024-12-15T13:29:41Z
Id
String Required

Unique identifier for this audit record

Source: random_guid()

Format GUID
Example c6d7e8f9-a0b1-2c3d-4e5f-6a7b8c9d0e1f
Operation
String Required

SharePoint operation performed

Source: Static value 'AnonymousLinkCreated'

Example AnonymousLinkCreated
OrganizationId
String Required

Microsoft 365 tenant identifier

Source: Derived from organization domain

Format GUID
Example b4c5d6e7-8f9a-0b1c-2d3e-4f5a6b7c8d9e
RecordType
Integer Required

Office 365 audit log record type (14 = SharePointSharingOperation)

Source: Static value 14

Example 14
Values
  • 14 SharePointSharingOperation - SharePoint and OneDrive sharing activities
ResultStatus
String Required

Outcome of the link creation operation

Source: random_choice(['Success', 'Success', 'Success', 'Failed'])

Example Success
Values
  • Success Anonymous link created successfully
  • Failed Link creation failed (permissions, policy restriction, or validation error)
UserKey
String Required

Unique identifier for the user in SharePoint membership format

Source: SharePoint membership format with user email

Format i:0#.f|membership|{email}
Example i:0#.f|membership|user@contoso.com
UserType
Integer Required

Type of user creating the link

Source: Static value 0

Example 0
Values
  • 0 Regular user
Workload
String Required

Office 365 service where the operation occurred

Source: Static value 'SharePoint'

Example SharePoint
UserId
String Required

User principal name of the account that created the link

Source: registry.get_random_user().email

Format Email/UPN
Example user@contoso.com
ClientIP
String Required

IP address from which the link was created

Source: random_choice([random_public_ip(), random_private_ip()])

Format IPv4
Example 198.51.100.45
ObjectId
String Required

Full SharePoint URL to the file or folder being shared

Source: SharePoint URL with site, library, and filename

Format URL
Example https://contoso.sharepoint.com/sites/Finance/Shared Documents/Q4_Financial_Report.xlsx
EventSource
String Required

Source of the sharing event

Source: Static value 'SharePoint'

Example SharePoint
ItemType
String Required

Type of item being shared

Source: random_choice(['File', 'File', 'Folder'])

Example File
Values
  • File Individual file being shared
  • Folder Folder being shared (higher risk - multiple files exposed)
ListId
String Required

GUID of the SharePoint list/library containing the item

Source: random_guid()

Format GUID
Example f1e2d3c4-b5a6-7c8d-9e0f-1a2b3c4d5e6f
ListItemUniqueId
String Required

Unique identifier for the list item

Source: random_guid()

Format GUID
Example a1b2c3d4-e5f6-7a8b-9c0d-1e2f3a4b5c6d
Site
String Required

GUID of the SharePoint site

Source: random_guid()

Format GUID
Example b2c3d4e5-f6a7-8b9c-0d1e-2f3a4b5c6d7e
UserAgent
String Required

Browser user agent string

Source: Random modern browser user agent

Example Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
WebId
String Required

GUID of the SharePoint web/subsite

Source: random_guid()

Format GUID
Example d3e4f5a6-b7c8-9d0e-1f2a-3b4c5d6e7f8a
CorrelationId
String Required

Correlation identifier for related operations

Source: random_guid()

Format GUID
Example e4f5a6b7-c8d9-0e1f-2a3b-4c5d6e7f8a9b
EventData
String Required

XML string containing sharing settings (AnonymousLinkType, Expiration)

Source: XML with link type and expiration date

Format XML
Example <SharingSettings><AnonymousLinkType>View</AnonymousLinkType><Expiration>2025-01-15T13:29:41Z</Expiration></SharingSettings>
HighPriority
Boolean Required

Indicates if this is a high-priority security event

Source: random_choice(['true', 'false', 'false']) - weighted toward normal priority

Example true
Platform
String Required

SharePoint platform identifier

Source: Static value 'SharePointOnline'

Example SharePointOnline
SiteUrl
String Required

Base URL of the SharePoint site

Source: SharePoint site URL

Format URL
Example https://contoso.sharepoint.com/sites/Finance
SourceFileExtension
String Required

File extension of the shared item

Source: random_choice(['xlsx', 'docx', 'pdf', 'pptx', 'zip'])

Example xlsx
SourceFileName
String Required

Name of the file being shared

Source: Contextual filename with extension

Example Q4_Financial_Report.xlsx
SourceRelativeUrl
String Required

Relative URL path to the file

Source: Relative path within SharePoint

Example sites/Finance/Shared Documents
TargetUserOrGroupName
String Required

Who can access via the anonymous link

Source: Static value 'Anyone with the link'

Example Anyone with the link
TargetUserOrGroupType
String Required

Type of sharing target

Source: Static value 'Anonymous'

Example Anonymous
UniqueSharingId
String Required

Unique identifier for this sharing link

Source: random_guid()

Format GUID
Example f7a8b9c0-d1e2-3f4a-5b6c-7d8e9f0a1b2c
ExternalAccess
Boolean Required

Indicates if the link was created from outside the corporate network

Source: random_choice(['true', 'false', 'false'])

Example true
ModifiedProperties
Array Required

Properties showing link settings (type and expiration)

Source: Array with AnonymousLinkType and LinkExpiration

ModifiedProperties[].Name
String Required

Property name (AnonymousLinkType, LinkExpiration)

Example AnonymousLinkType
ModifiedProperties[].NewValue
String Required

Link permission type or expiration date

Source: Link type (View, Edit, Review) or ISO date

Example View
Values
  • View Read-only access (lowest risk)
  • Edit Read and write access (higher risk)
  • Review View and comment access
ModifiedProperties[].OldValue
String Required

Previous value (empty for new links)

Source: Empty string