Share and Manage Access to OneDrive or SharePoint Files
Share and Manage Access to OneDrive or SharePoint Files
OneDrive and SharePoint files are private until access is granted, but a link's reach depends on the option selected. Before sharing, confirm the file is in the correct business location, contains no information the recipient should not see, and may be shared under your organization's policy. Use the least-permissive option that meets the need.
Create a sharing link
Select the file or folder in OneDrive or SharePoint and choose Share. Open the link settings or gear icon before sending.
- Specific people restricts the link to named recipients. Forwarding the invitation does not grant a new person access. This is the safest normal choice for a defined audience.
- People in your organization with the link allows anyone in the organization who obtains the link to use it.
- People with existing access does not grant new permission; use it when you only need to resend a convenient link.
- Anyone with the link may work for people outside the organization and can be forwarded. It may be disabled by policy. Use it only when approved and appropriate for the content.
Choose Can view unless recipients need to change the content. Folder Edit permission can allow people to add, copy, move, edit, rename, share, and delete contents, so review the folder before granting it. Depending on your account and policy, you may also see block download, expiration, password, or Word review-mode options. Greyed-out choices usually reflect organization policy; do not work around them with a personal account.
Enter recipients, add context, and send, or copy the configured link into an approved message. Double-check external addresses and similarly named contacts. Avoid posting a business sharing link in a public channel.
Fix “access denied” or a link that does not work
Ask the recipient to open the link in a private/incognito browser window and sign in with the exact email address you authorized. A person signed into another Microsoft account may be denied even though their invitation is valid. If the link requires a one-time passcode, they should use the code delivered to the invited address and never forward it.
If the file or folder was moved, a previous OneDrive sharing link may stop working; create a new link from the item's current location. Confirm that the item still exists, that you are its owner or authorized sharer, and that the recipient has not been removed. For SharePoint, access may come from the parent folder, library, site, or a group, so removing one link may not remove every route to the item.
Review or remove access
Select one file or folder, open Details/Information, and choose Manage access. Review people, direct access, and links.
- Remove an obsolete sharing link to stop access through that link.
- Remove or change a person's direct access when the interface allows it.
- Choose Stop sharing only if you own the item and intend to remove sharing broadly.
- For work accounts, use Shared > By me in OneDrive to review items you have shared.
Microsoft notes that a sharing link cannot simply be changed from edit to view or view to edit. Delete the old link and create a new one with the correct permission. Before removing access, consider active collaboration, business ownership, and records obligations.
If a user still has access after you remove a link, they may have direct access or inherited permission from a parent folder, Microsoft 365 group, Team, or SharePoint site. Do not break inheritance or change site membership unless you are authorized; escalate with the exact file URL and user.
When to contact support
Contact your IT help desk when external sharing is required but unavailable, the owner has left, access is inherited and cannot be identified, confidential data was shared incorrectly, or permission changes do not take effect. Treat accidental external disclosure as a potential security incident and follow your reporting process promptly rather than only deleting the link.
Provide the item URL, site/library, owner, recipient address, intended permission, link type, exact error, whether the recipient used the invited account, and screenshots with file content hidden. Never include passwords or one-time codes.