Power Platform Community Forum Thread Details

How to prevent "Create share link" from sharing with anonymous users

Setup

- Our Microsoft 365 tenant does not allow external sharing for OneDrive and SharePoint:

Now, we can create a demo Flow with a single action: "Create share link":

When we run this flow, it generates an anonymous link:

Link format: https://cleverpointdev-my.sharepoint.com/personal/admin_cleverpointdev_onmicrosoft_com/_layouts/15/download.aspx?UniqueId=<ID>&tempAuth=<JWT_Token>&ApiVersion=2.0

Security Issue: This anonymous link can be opened from any computer, without a credentials prompt. The worst thing is that this hyperlink can be opened from unmanaged devices.

I have tested this behaviour in several M365 tenants. Our security team is really concerned about this "data leak" issue. It looks like anyone can share any file whatsoever byappsing all organizational security policies.

More details: When I go to the Access settings of the file I've shared with Power Automate, I don't see any sharing hyperlinks dispite the fact that I've generated one: