SharePoint Shared Link Discovery, Site Access Review Scalability, and DAG Remediation Approach

Hi,

Let me help address each of your questions:

1/ How to identify all shared links within a large SharePoint site

SharePoint DAG can help identify sites with potential oversharing and recent sharing-link activity. However, the DAG sharing-link reports are primarily designed for risk discovery and prioritization. They should not be considered a complete historical inventory of every active sharing link and all associated metadata.

There are other approaches you can consider:

• Run the Site permissions across your organization report to establish a current permissions baseline and identify sites with high numbers of Anyone links, People in your organization links, guest permissions, external participants, and uniquely permissioned items.
• Run the Sharing links activity reports to identify sites where Anyone, People in your organization, or Specific people external links were recently created.
• Use Microsoft Graph to enumerate the current sharing permissions on files and folders in the affected site. Graph permission objects can provide details such as:
  • Link type and scope
  • View or edit permission
  • Expiration date
  • Specific recipients, where applicable
  • Permission and item identifiers
• Use Microsoft Purview Audit to identify historical details such as when a sharing action occurred, who performed it, and the user or group targeted by the action.

2/ Using Site Access Reviews for more than 1,000 review items

If one site contains more than 1,000 affected files, folders, links, or permission entries, I would recommend this review order:

• Anyone links with edit permission
• Anyone links without expiration
• Broad links to sensitive or regulated content
• External links with edit permission
• External recipients whose business relationship may have ended
• People in your organization links on restricted or private content
• Everyone or Everyone except external users permissions
• Folders with unique permissions or broad sharing, because they may expose multiple child items
• Remaining direct grants and broken permission inheritance

Administrators can also use DAG or an exported inventory to pre-prioritize the items before assigning the review to the site owner. Site owners can use Manage access to delete links, remove users, adjust group membership, or change permissions. They should complete the review only after the high-risk findings have been addressed and any retained broad access has been documented with a business justification.

3/ Recommended remediation strategy is for addressing overshared links identified through SAM DAG reports in large-scale SharePoint environments

For remediation, I recommend avoiding indiscriminate deletion. Each high-risk link should be validated against its business purpose.

• Remove obsolete Anyone links.
• Replace broad links with Specific people links.
• Reduce Edit access to View where possible.
• Add expiration to temporary external access.
• For recurring collaboration, managed SharePoint or Microsoft Entra groups are generally preferable to repeated item-level sharing.

After remediation, preventive settings should also be reviewed. Depending on the site’s business requirements and sensitivity, this may include setting Specific people as the default link type, requiring link expiration, disabling Anyone links, reducing the external-sharing level, and restoring standard permission inheritance.

In short, the suggested approach should be using DAG for risk identification, Site Access Reviews for owner validation, Microsoft Graph for current permission inventory, and Purview Audit for historical sharing context.

Hope this information is useful. Should you have any further questions, please feel free to share them in the comments below. I'm very happy to help.