How to Remove SharePoint Sharing Links using PowerShell

In our earlier blog we explored how to export all sharing links to track and audit file sharing across your SharePoint Online environment. The post helped admins identify various link types, spot risky shares, and gain visibility into shared content across sites. After receiving several requests from our readers, we’re now taking the next step, removing those unwanted sharing links that may pose a risk or are simply no longer needed.

While file and folder sharing play a key role in enabling seamless collaboration, it’s important to regularly audit and remove outdated or risky sharing links to maintain control over sensitive data.

• Prevent accidental data exposure: Audit externally shared links especially those shared without proper oversight, to avoid leaks of sensitive information.
• Eliminate unnecessary access: Clean up expired or unused links to avoid clutter and unnecessary access persistence.
• Revoke unsecured share links: Detect and remove overly permissive shared anonymous links that bypass authentication and pose a high security risk.

 Tip: Encourage users to follow secure sharing practices in SharePoint Online to reduce potential risks from the start.

You can use the following methods to remove sharing links in SharePoint Online based on your management preferences and scale:

1. Remove sharing links using SharePoint admin center.
2. Remove sharing links using PowerShell cmdlet.
3. Remove sharing links using PowerShell script (Recommended) 

1. In the SharePoint admin center , navigate to Sites>Active sites, select the specific site where the file/folder resides.
2. Click the URL near to the Site name column, you will be re-directed to SharePoint Online document library and now locate the file or folder.
3. Right-click and select “Manage Access.” In the panel, switch to the “Links” tab.
4. To remove access for a specific user, click the dropdown under “This link works for” and hit the X to revoke access, then confirm.

5. To delete a link (e.g., “Anyone” link), click the delete icon next to it and confirm the prompt.
6. Once removed, users accessing the link will see an error message.

The Manage Access option in SharePoint Online offers a simple way to remove shared links, but it lacks scalability for larger environments. It’s entirely manual, time-consuming, and doesn’t support bulk actions or provide centralized visibility across the tenant. 

Connect to SharePoint Online using PnP PowerShell and run the below cmdlet to revoke access for a particular file.

• FileUrl: Specifies the URL of the file for which you want to remove the sharing link.
• Identity: Specifies the ID of the specific sharing link to remove. This ID can be obtained using Get-PnPFileSharingLink.

While the Remove-PnPFileSharingLink cmdlet offers precise control to remove a specific file sharing link, it requires you to manually retrieve the file URL and link ID for each item. This means you must loop through every file in every site to perform cleanup at scale, which is inefficient and time-consuming in larger environments.

To overcome native limitations, we’ve developed a PowerShell script that first scans your entire SharePoint Online environment and exports sharing link details to a CSV file. This enables admins to review and verify shared content before taking action. Once verified, the same script can be re-run with removal filters to bulk delete unwanted sharing links, offering a secure and controlled approach to sharing link management.

Download script: RemoveSharingLinks.ps1

• Includes report generation to preview links before removal.
• Removes files & folders’ sharing links based on 20+ filtering criteria.
• Supports removing sharing links by link types: Anonymous, Company, and Specific People links.
• Allows to revoke sharing permission based on link expiration status, such as active links, expired links, etc.
• Targets specific SharePoint sites for scoped cleanup actions.
• Automatically installs the required PnP PowerShell module with your confirmation if it’s missing.
• Supports authentication using certificate-based login, MFA and non-MFA accounts.
• It is scheduler-friendly, making it ideal for automating regular audits and link cleanup tasks.

This script exports all shared links in SharePoint Online along with the attributes like Site Name, Library, Object Type, File/Folder Name, File/Folder URL, Link Type, Access Type, Roles, File Type, Link Status, Days Since/To Expiry, Friendly Expiry Time, Password Protected, Block Download, Link Removal Status.

1. Download the PowerShell script shared above.
2. Open Windows PowerShell and navigate to the folder where the script is stored.
3. After downloading the PowerShell script, choose any of the following execution methods based on your requirements.

Note: Since the script uses PnP PowerShell, it requires an Entra ID app registration to support both interactive and non-interactive logins. Ensure you register an app in Entra ID for PnP PowerShell and granted the necessary application permissions: ‘Files.ReadWrite.All’ (Microsoft Graph) and ‘Sites.Read.All’ (SharePoint).

Method 1: Run the Script Interactively (Supports MFA/Non-MFA)

Run the script as below:

This method prompts you to enter Tenant Name and the Client ID of your Entra ID app. Once entered, it will generate csv report of all sharing links. After reviewing the report, you can run the script with –RemoveExpiredLinks as shown below to revoke them

To remove specific types of sharing links, see the ‘More Use Cases’ section below.

Method 2: Unattended Execution with Certificate-Based Authentication

For unattended execution, you can use certificate-based authentication as shown below. Depending on your preference, you can either create a self-signed certificate or use CA certificate.

The above example will automatically cleanup all expired links. Admins can schedule the script using Task Scheduler or Azure Automation to periodic cleanup.

Method 3: Run the Script with Explicit Credentials

Using this method, you can schedule the script by explicitly specifying credentials (not recommended). To ensure uninterrupted execution, disable MFA for the account via a CA policy.

Points to Remember:

• This script requires PowerShell 7 or higher, as the latest PnP PowerShell versions are only supported on PowerShell 7+.
• During interactive sign-in, if you’re not an owner of certain sites, you won’t be able to retrieve their sharing link data. These sites will be skipped, and you’ll see a warning like: Attempted to perform an unauthorized operation.
• To collect sharing link data from all SharePoint sites, regardless of site ownership, use Method 3: certificate-based authentication. Make sure the app registration has the required application-level permissions. Otherwise, you’ll encounter the error: Get-PnPFileSharingLink: Either scp or roles claim need to be present in the token.

This PowerShell script helps remove sharing links based on 20+ real-time scenarios. Below are the few major use cases.

1. Remove sharing links from a specific SharePoint sites (Import CSV)
2. Remove all anonymous links
3. Remove all organization-wide sharing links
4. Remove links shared with specific people
5. Remove expired sharing links
6. Remove links that never expire
7. Remove active anonymous links
8. More granular filtering

Tip: Before taking cleanup actions, it’s important to review the links that will be removed. You can run the script without -RemoveSharingLinks to generate a report. This generates a CSV report listing all links that falls under given criteria. Review it, and when ready, re-run the same format with -RemoveSharingLinks to revoke them.

When you want to clean up sharing links from particular sites such as completed projects or compliance-related sites, you can target these specific sites using a CSV file.

The script accepts the parameter -ImportCsv, which specifies the path to a CSV file containing the list of SharePoint site URLs to be cleaned. To perform the removal, use the –RemoveSharingLinks parameter.

For example, to remove sharing links only from the sites listed in your CSV, run:

This ensures only specified site collections are scanned and cleaned. The script reads each site from the CSV and removes sharing links.

Sample Input:

Anonymous links pose a significant risk since they allow unauthenticated access. To remove all the anonymously shared file/folder access.

To remove all anonymously shared file and folder access, use the -GetAnyoneLinks parameter, which filters and targets these public links. Combine this with the -RemoveSharingLinks parameter to revoke them:

Optionally, you can narrow down the cleanup to specific sites by providing a CSV file containing site URLs with the -SitesCSVPath parameter:

This revokes all public links and improves your overall data sharing security.

Tips:

• Audit anonymous access in SharePoint Online regularly to spot unauthenticated file/folder sharing and ensure sensitive content isn’t publicly accessible.
• Limit external sharing to specific sites to prevent unnecessary data exposure to unauthenticated users.

Company links allow any user in your organization to access the content. While convenient, they can lead to over-permissioned access. This helps ensure only necessary internal access is granted and maintained.

Use the -GetCompanyLinks parameter to target company-wide links and the -RemoveSharingLinks parameter to revoke them:

You can also refine the cleanup by combining the -NeverExpiresLinks parameter, which targets links that never expire:

In addition to -NeverExpiresLinks, the script also supports filters like LinksWithExpiration, -ExpiredLinks, and -SoonToExpireLinks to help admins audit and clean up sharing links based on time-bound access criteria.

People-specific links are used for confidential, internal and external sharing. When a project ends or teams change, these links might become obsolete.

To target and remove such links, use the -GetSpecificPeopleLinks parameter, which filters links shared with specific users. Combine this with the -RemoveSharingLinks parameter to revoke access:

You can also limit the cleanup to particular sites by specifying a CSV file with site URLs using the -SitesCSVPath parameter:

This ensures that sensitive files & folders are no longer accessible to unneeded users.

Expired links no longer provide access, but they remain in your system. To clean up these outdated entries and reduce clutter.

Use the -ExpiredLinks parameter to specifically target expired sharing links. Pair it with the -RemoveSharingLinks parameter to remove them:

This ensures only currently active and relevant links stay intact while expired ones are cleared out.

Links without expiration are risky and may continue to provide access long after they are needed. To identify and remove such links.

To target and remove such links, use the -NeverExpiresLinks parameter. This identifies links that have no expiration set. Pair it with the -RemoveSharingLinks parameter to delete them:

You can further narrow the cleanup by combining with link type filters, such as GetAnyoneLinks, which targets anonymous public links specifically.

This helps enforce time-bound access controls across all link types.

While some anonymous links may be inactive or expired, active anonymous links remain a security risk as they still grant access without authentication. Admins should prioritize revoking these links to prevent unauthorized access.

To do this, use the -GetAnyoneLinks parameter to target all anonymous links, and combine it with -ActiveLinksOnly to filter for links that are still valid and accessible. Use the -RemoveSharingLinks parameter to revoke them:

If you want to limit the scope to specific sites, you can provide a CSV file containing site URLs using the -SitesCSVPath parameter:

This ensures that only live anonymous links are removed, reducing risk without affecting expired or inactive entries.

Admins often need to go beyond basic link types or site-wide cleanups. This script allows you to combine site scope, link type, and expiration status to perform highly targeted link removals. This level of flexibility helps maintain tighter control over access permissions while minimizing manual effort. You can filter by:

• Site Scope
  • ImportCsv – To specify a CSV file with a list of SharePoint site URLs you want to target.
  • If omitted, the script scans all sites in the tenant.
• Link Type
  • GetAnyoneLinks – Targets anonymous links.
  • GetCompanyLinks – Targets links shared with everyone in the organization.
  • GetSpecificPeopleLinks – Targets links shared with selected users.
• Expiration Status
  • ExpiredLinks – Selects links that have already expired.
  • NeverExpiresLinks – Targets links with no expiration date.
  • LinksWithExpiration – Filters links that were created with an expiration date.
  • SoonToExpireLinks – Identifies links set to expire soon (you can define the days using an additional parameter).

• Remove links
  • RemoveSharingLinks – Required to actually revoke/delete the matching links found.

You can combine these parameters to achieve precise results. For example:

• Remove expired anonymous links from specific sites:

• Find never-expiring company links across the tenant:

This granular filtering capability empowers admins to proactively identify and remove risky or unnecessary sharing links with maximum precision.

We hope this blog helped you understand how to remove sharing links in SharePoint Online using PowerShell based on different needs. Have questions? Feel free to leave a comment below!