Microsoft 365 external sharing security starts with a simple
question: who can still open your business files after the work is
finished?

A contractor receives a project folder. An accountant gets year-end
documents. A customer receives a proposal link. Each action may be
legitimate, but the resulting access can remain long after anyone
remembers granting it.

For small businesses in Greater Vancouver, a useful review should
identify unnecessary exposure without breaking everyday collaboration.
Start with sensitive locations, understand how access was granted, and
have a business owner approve changes before removing permissions.

1 Define the
business purpose of external sharing

Begin with the work, not the admin settings. List the teams that
regularly exchange information with clients, suppliers or contractors.
Identify the files involved and how long the relationship should
last.

Separate material intended for broad distribution from confidential
working documents. A public brochure and a payroll spreadsheet should
not follow the same sharing rules.

For each important location, record an accountable business owner,
the permitted external audience and the review date. If nobody can
explain why a folder is shared, place it in the review queue rather than
assuming the access is necessary.

2 Understand which link
grants access

Microsoft distinguishes three main sharing-link types: Anyone, People
in your organization and Specific people. Its
sharing-link guidance explains that Anyone links can be used without
authentication and forwarded to others. Specific people links require
the recipient to authenticate as a named recipient.

For confidential collaboration, consider named-recipient sharing
rather than anonymous links. An organization-only link is not suitable
for an external client, and it can still be passed among internal
members who possess it.

Do not judge access from a link’s appearance or the email that
delivered it. Check the actual link type, recipients and permission
level in Microsoft 365.

3 Review
settings at both organization and site level

An administrator should compare the sharing policy for the
organization with the settings on each important SharePoint site and
relevant OneDrive account.

Microsoft’s
external-sharing overview explains that the most restrictive
applicable organization or site setting takes precedence. OneDrive
cannot be configured more permissively than SharePoint at the
organization level.

Review related guest and collaboration controls as well; a single
switch does not describe the complete access model. Record the current
settings before proposing changes.

Pilot tighter settings with one low-risk collaboration area first.
Confirm that approved clients can still complete their work before
applying a wider change.

4 Inspect actual
permissions and link scope

Start with finance, HR, client records, contracts and completed
projects. For selected files and folders, inspect links, direct access
and relevant group or site membership.

Ask whether the recipient needs one document, an entire folder or a
whole site. Broad access is easy to grant when a deadline is approaching
and harder to justify later.

Check whether recipients need to edit or only view. Where possible,
use a dedicated collaboration area instead of sharing a folder that also
contains unrelated internal material.

Removing one link is not a complete access review: another permission
route may still exist. Verify the effective result rather than treating
a deleted link as proof that all access has ended.

5 Give guest access
an owner and an end point

An unfamiliar guest account is not automatically malicious. It may
belong to a legitimate customer or adviser. Equally, a familiar company
name is not proof that access remains appropriate.

Ask the internal sponsor to confirm the guest’s identity, current
purpose, required locations and expected end date. Review completed
engagements and suppliers whose contracts have changed.

Where supported and configured, use guest-access expiration as a
backstop. Do not confuse the expiry of a sharing link with removal of
every permission a person holds.

Before deleting a guest from the directory, check other projects and
applications that may still depend on that identity. Document the
decision and coordinate legitimate access through the right owner.

6 Make safer sharing
the convenient default

Agree a short set of rules staff can actually follow. Specify when
named recipients are required, when editing is appropriate and who
approves exceptions for anonymous sharing.

Microsoft’s
sharing-settings documentation describes default link types,
Anyone-link expiration and permission restrictions. Treat those options
as controls to evaluate, not settings to apply blindly across every
workflow.

For example, a client document-upload process may behave differently
when anonymous sharing is disabled. Test the real process before
changing it.

Show employees how to select recipients and review access before
sending. A short demonstration using a harmless sample document is more
useful than a policy that nobody knows how to apply.

7 Test changes
without exposing real information

Use a test document containing no client or personal data. Confirm
that the intended external recipient can access it with the expected
permissions.

Then verify the negative case: an unrelated test identity should not
gain access through a Specific people link. Do not send confidential
files to personal accounts simply to test restrictions.

After approved cleanup, retest the relevant permission routes. Check
with the business owner that legitimate collaboration still works, and
retain a short record of the settings changed and the results.

Permissions control future access; they do not recall files someone
has already downloaded. Include that limitation when deciding what
information should be shared in the first place.

8 Turn the findings
into a recurring review

A useful review produces a manageable action list, not just an export
of accounts. Record:

• The site, folder or document reviewed
• Its business owner and external recipients
• The sharing method and permission level
• The decision to retain, narrow or remove access
• Any exception, responsible person and next review date

Prioritize confidential information exposed through anonymous links,
unexplained broad permissions and access associated with completed work.
Coordinate changes rather than mass-deleting guests or links without
understanding dependencies.

Repeat the review when projects close, staff leave or suppliers
change. A quarterly check of sensitive collaboration areas is a
practical starting point, with more frequent checks where the business
risk warrants them.

Keep sharing within
the wider security plan

File permissions are one part of Microsoft
365 security hardening. Identity protection, administrator access,
managed devices, monitoring and recovery planning also matter.

Pair the sharing review with a check of backup and recovery
requirements. Access controls reduce inappropriate access; recovery
arrangements address different problems, including deletion or damaged
data.

SOS Computer Experts helps businesses review Microsoft 365 sharing
settings, guest access and collaboration practices. Ongoing managed IT and Microsoft
365 support is available only in North Vancouver, Vancouver,
Burnaby, Coquitlam, Richmond, Surrey and Langley.

Outside those seven cities, including Victoria, Calgary, Edmonton and
Toronto, SOS offers only fixed-scope enterprise cybersecurity
assessments and project-based enterprise security work, not MSP or
general cloud support.

Request a Microsoft 365
sharing review

Contact SOS Computer
Experts to discuss a focused review of external links, guest
permissions and sensitive collaboration areas. Start with a clear scope
and leave with owners, approved changes and a repeatable review
process.

Main office: 778-262-2133. WhatsApp only: 672-515-7031.