Shared once, open forever? External sharing in Microsoft 365

A file for the tax advisor, a project folder for a partner, a link to a client: external sharing is part of everyday work. Microsoft 365 makes it easy. That is precisely why it is worth asking what happens after clicking "Share". Who can open the link? Can the person only read or also edit? And who removes access again when the collaboration ends?

The problem is rarely the one consciously shared file. It is the accumulated access permissions that nobody thinks about after a few months.

A link is not just a link

Behind similar-looking links can be very different permissions. An "Anyone" link works for anyone who has it. If forwarded, another person can gain access. No login is required for this. A link for "Specific people", on the other hand, is bound to the specified recipients; forwarding alone does not give others access. An organization-internal link is not intended for external guests. Microsoft explains the link types here.

For confidential documents, we therefore generally recommend targeted sharing with named recipients. An anonymous link may work for a public event flyer. For a contract draft or personnel file, the same convenience is not a good justification.

The second selection is equally important: View or Edit? Someone who is supposed to review an offer does not automatically need to be able to change the entire folder.

The file is only part of the picture

A project can quickly be shared as a folder. Later, new documents are added, and the original sharing arrangement is forgotten. That is why it should be clear before sharing any folder which documents are allowed to go there in future. A cleanly separated exchange folder is easier to control than an area that has grown over time, where internal notes and customer documents lie side by side.

Different access routes also come into play. A person can access via a link, direct permission, or membership of a parent group or site. Simply deleting a link is then not necessarily sufficient. Microsoft also distinguishes these paths in access management. Information on reviewing and removing permissions.

A guest account in the directory is therefore neither automatically a problem nor conclusive evidence of actual file access. What matters is what this person can actually open.

Good default settings prevent many errors

A company should not make the same basic decision again for every document. Suitable default values for link type and permissions, separate areas for external collaboration, and clear responsibilities are worthwhile. Accounting may need different sharing options than a project team.

Microsoft 365 offers settings at the organizational and site level. A single site can be set more restrictively than the parent environment. Where expiry rules are supported, they can help additionally. However, they do not replace the control of other permissions or already downloaded copies. Overview of external sharing.

Our advice: first test a typical workflow with actual participants. Can the external recipient open the documents without unnecessary detours? Are the internal files really not visible next to them? Only then use the same structure more broadly.

Cleanup needs a reason and a responsible party

"We review sharing occasionally" is not a reliable process. Better is a quick check at project completion, when changing service providers, and additionally on a fixed schedule. This does not require the entire company to be reviewed at once. Start with the areas where sensitive data is stored.

For each area, four questions are sufficient at first:

1. Who is responsible for the content and can confirm which external recipients belong to it?
2. Which guests and links are still needed?
3. Are there additional access routes through groups or parent folders?
4. Was it verified after cleanup that required access still works?

Do not simply delete everything that looks old. A long-running client engagement may still require an existing account or permission. IT can display and change permissions; whether collaboration still exists must be answered by the responsible department.

What revoking access does not reverse

If a recipient has already downloaded, copied, or photographed a file, removing the share does not get that copy back. Access controls govern the access you manage; they do not retrospectively undo every onward disclosure. That is why the decision begins before sharing: Does the complete case file need to be shared or is just the one needed document sufficient?

Conclusion

External collaboration does not have to be complicated. It needs suitable default settings, separate storage areas, and a clear process for ending access. The most important question is not just "Is the file shared?" but "With whom, for what, and for how long?" Clear answers make it easier to keep track when the next project changes.

Would you like to have your sharing settings reviewed? Schedule an appointment with shinpo IT.