How to share files with people outside your business safely

The three kinds of link, in plain terms

When someone clicks Share in OneDrive or SharePoint, they choose who the link works for. An anyone link works for whoever has it, with no sign-in, which means it can be forwarded, posted or found in a compromised inbox and still open the file. A people in your organisation link works only for your own staff. A specific people link works only for the email addresses typed in, and an outsider proves who they are with a one-time code or their own Microsoft account.

For most external sharing, specific people is the right default. The client gets a link that only they can open, you can see who has access, and if the email is forwarded to the wrong person it does not work for them. Anyone links still have a place, such as a brochure for wide distribution, but they should be the deliberate exception.

Set the defaults centrally

In the SharePoint admin centre you can choose how far sharing is allowed to go for the whole organisation and then tighten it per site. A common small-business setup allows sharing with existing and new guests on general sites, turns anyone links off or limits them to view-only with a short expiry, and blocks external sharing entirely on the finance and HR site.

You can also change what the Share button suggests first. Making specific people the default link type means staff who click quickly still pick the safer option. Requiring links for outsiders to expire after a set number of days stops last year's quotes and contracts from sitting open indefinitely. These changes take minutes and protect every future share.

Choosing the right permission

Decide between view and edit every time. Most external sharing is view-only: a quote, a report, a set of drawings. Give edit access only when the other party genuinely needs to change the file, such as a jointly prepared tender. For view-only sharing of sensitive material, the block download option on certain link types lets the recipient read the document in a browser without saving a copy.

Share the smallest thing that does the job. Sharing an entire client folder because it is quicker than picking three files means the client may see internal notes, pricing workings or another client's documents that someone saved in the wrong place. If you share a folder regularly with a client, create a dedicated folder for exactly what they should see.

Guests and collaboration in Teams

For ongoing work with an outside party, such as a contractor working on a project for months, adding them as a guest to a team or a specific SharePoint site is cleaner than sending dozens of separate links. They sign in with their own email, see only what that team or site contains and can be removed in one step when the work finishes.

Guests accumulate. Review your guest list in the admin centre every few months and remove people whose work has ended. Microsoft 365 can also be set to expire guest access automatically or to ask site owners to confirm whether each guest still needs it. Old guests are a common, quiet route for data to leave the business long after anyone remembers inviting them.

Checking what is already shared

Most offices have years of sharing done before anyone set rules. SharePoint and OneDrive keep a record of what has been shared and how. Admins can run sharing reports per site, and individuals can open Manage access on any file or folder to see the links that exist and remove them. A quick audit usually turns up anyone links to payroll spreadsheets or old client folders.

Prioritise by sensitivity. Look first at finance, HR, client personal information and anything containing bank details or IRD numbers. Under the Privacy Act 2020, an open link to personal information that is accessed by the wrong person can be a privacy breach the business has to assess and possibly notify, so cleaning up these links is worth doing before something goes wrong.

Habits worth teaching staff

Three habits cover most of the risk. Check the link type before sending, especially if the share dialog defaulted to something broad. Share the file rather than the folder unless the folder was set up for that person. And when a piece of work finishes, remove external access rather than leaving it in place just in case it is needed again.

Teach staff to recognise the reverse risk too. Fake file-sharing notifications that look like a OneDrive or SharePoint share are a common way to steal passwords. A genuine share from a client opens to a Microsoft page that asks for a code sent to your email, not a password on a strange website. When in doubt, ask the sender by another channel.