Sharing files with clients from OneDrive and SharePoint safely
Link types, guest accounts, expiry dates and cleanup: how a small business can share files with clients from Microsoft 365 without losing track of who has access.
Sending a client a contract, a set of drawings or a folder of photos from OneDrive or SharePoint takes a few clicks. Knowing who can open that link six months later is harder. For most small businesses on Microsoft 365, external sharing has grown one link at a time, with nobody quite sure what is still open. This guide explains the choices you make each time you share, the settings an administrator should set once, and how to clean up what is already out there.
The link types, in plain English
When you click Share in OneDrive or SharePoint, the link settings offer up to four options, depending on what your administrator allows:
- Anyone with the link. No sign-in needed. Whoever has the link, including anyone it gets forwarded to, can open it. Convenient, and the riskiest choice for anything confidential.
- People in your organization. Only your own staff, signed in. Useless for clients, but the right default for internal sharing.
- Specific people (shown in some versions as "People you choose"). Only the email addresses you enter can open it, after proving who they are. This is the right choice for most client work.
- People with existing access. Simply sends a link to people who already have permission; it grants nothing new.
In the same settings you can usually untick "Can edit" to make the link view-only, block downloads for some file types, and, for Anyone links, set an expiry date.
What changed with outside guests
During 2026 Microsoft has been moving SharePoint and OneDrive external sharing onto Microsoft Entra B2B, its standard system for guest accounts, and retiring the older SharePoint-only one-time code. In practice, when you share with a specific outside person, they now appear as a guest in your Microsoft 365 directory. If they don't have a Microsoft work or personal account, they can still sign in with a code sent to their email.
Two practical effects. First, some older links that depended on the retired SharePoint code may now show "access denied" to the client; sharing the file or folder again usually fixes it. Second, your guest list in the Microsoft 365 admin center is now a fairly complete record of who outside the company can reach your files, which makes reviewing it worthwhile.
Settings an administrator should set once
- Change the default link type from Anyone to Specific people in the SharePoint admin center, so the safe choice is the one staff get without thinking.
- Decide whether Anyone links are allowed at all. If they are, set a maximum expiry so forgotten links close on their own, and consider making them view-only by default.
- Limit sensitive sites. SharePoint lets you set external sharing per site. Finance and HR sites can be closed to outsiders while project sites stay open to clients.
- Set guest access to expire or be reviewed, so clients from finished projects don't keep access for years.
- Consider allowing or blocking domains if you only ever share with a few known partners.
Habits for staff
- Share the smallest thing that does the job: one file rather than the whole folder, a subfolder rather than the whole site.
- Use Specific people for anything with personal, financial or client-confidential information.
- Check the email address before sending. Autocomplete picks the wrong "Mike" more often than anyone admits.
- When a project ends, open Manage access on the folder and remove the outside people.
Cleaning up what is already shared
Each user can see what they have shared from OneDrive, and the Manage access panel on any file or folder shows its links and the people who have access. Administrators can review guest accounts in the Microsoft 365 admin center and run sharing reports for SharePoint sites. Start with the sites that hold the most sensitive information, remove Anyone links that are no longer needed, and delete guests you don't recognize. Doing this when someone leaves the company is also essential: our guide to Microsoft 365 offboarding covers handing over their OneDrive before it is deleted.
How we can help
We can review your sharing settings and guest accounts and set sensible defaults, as part of our data loss prevention and small business IT support services. Call (213) 986-4855.