How do I see all external users in a SharePoint site?

External users appear in site groups and direct grants with #ext# in their login name. Get-PnPUser filtered on #ext# lists everyone known to the site; Get-SPOExternalUser lists guests at tenant level. Neither shows item-level shares without walking broken inheritance.

How do I find files shared with "Anyone" in SharePoint?

Anonymous links are recorded in the audit log (AnonymousLinkCreated / AnonymousLinkUsed) and in the Data Access Governance sharing-links report. Per file, Get-PnPFileSharingLink lists active links and their scope.

Can I audit external sharing in SharePoint without Advanced Management?

Yes, with PowerShell and the audit log, one site at a time. Advanced Management adds tenant-wide snapshot reports and site access reviews.

How do I remove an external user from SharePoint completely?

Remove them from every site group and direct grant, delete any sharing links they used, then remove the guest account in Entra (or Remove-SPOExternalUser). Leaving the guest account with no permissions still lets existing links work until they expire.

Every external user and sharing link in your SharePoint, without buying Advanced Management

Guests in the site groups, guests on individual files, and "anyone with the link" links are three different lists in three different places. Here is how to get each with PowerShell, and what Microsoft's paid reports add.

"How many outsiders can get into our SharePoint?" has three answers, and the site's Permissions page gives at most one of them.

The three lists

Guests with site-level access — external accounts in Owners/Members/Visitors or a custom group, or granted directly. Login names contain #ext#.
Guests with item-level access — a file or folder with broken inheritance where an external user was granted access, usually by the Share button. Not visible on the site's Permissions page.
Links that grant access without a named user — Anyone with the link (anonymous) and People in your organisation links. No guest account exists; anyone holding the URL is in.

List 1: guests on the site

Connect-PnPOnline -Url https://contoso.sharepoint.com/sites/Finance -Interactive

Get-PnPUser | Where-Object LoginName -like '*#ext#*' |
  Select-Object Title, Email, @{n='Groups';e={ (Get-PnPGroup | Where-Object { (Get-PnPGroupMember -Group $_.Title).LoginName -contains $_.LoginName }).Title -join ', ' }}

Tenant-wide, from the SharePoint Online shell:

Connect-SPOService -Url https://contoso-admin.sharepoint.com
Get-SPOExternalUser -SiteUrl https://contoso.sharepoint.com/sites/Finance -PageSize 50

Get-PnPUser returns everyone the site has ever resolved, including guests who no longer hold any permission; cross-check against role assignments before reporting them as "has access".

List 2: guests on individual items

This means walking every list for items with unique permissions and reading their role assignments — the same loop as the full permissions report, filtered to #ext# principals. There is no shortcut in the UI; Manage access on each file is the only place it shows.

Sharing links appear in role assignments as SharePoint groups named SharingLinks.<item-guid>.<scope>.<link-guid>. Per file:

Get-PnPFileSharingLink -Identity '/sites/Finance/Shared Documents/Board pack.pdf'

shows each active link with its scope (Anonymous / Organization / Users), permission and expiry. For "which files on the site have anonymous links" the audit log is faster than per-file calls:

Connect-ExchangeOnline
Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-90) -EndDate (Get-Date) `
  -Operations AnonymousLinkCreated, SecureLinkCreated, SharingSet `
  -ObjectIds 'https://contoso.sharepoint.com/sites/Finance/*' -ResultSize 5000 |
  Select-Object CreationDate, UserIds, Operations, ObjectId

Tenant-level, without any add-on: SharePoint admin centre → Sharing → set a default link expiry for Anyone links and consider disabling them.

What Advanced Management adds

The Data Access Governance reports — sharing links (sites with the most created), shared with Everyone except external users, site permissions for users — and site access reviews that ask site owners to attest. They are tenant-wide snapshots, good for finding which sites to look at. They still do not give the per-site list of who and how, and they cost a per-user licence.

The report to produce

One table, three sections: guests with site access (and via which group), guests with item access (and on which path), active sharing links by scope. Flag Anyone links and Everyone except external users grants at the top. That is what an oversharing review needs.

WhoHasAccess365 builds the first section for free; the item-level sweep and sharing-link enumeration are what its Pro tier adds. All of it runs from a SharePoint page under the admin's own permissions and is read-only.