Shared file links: check who can open your documents
Review people, sharing links and inherited folder access using OneDrive as an example. A practical routine for closing a project or sending a new file.
Autumn projects can leave a trail of shared coursework, event lists and family documents in cloud storage. Deleting a message containing a link, or simply forgetting that link, does not end access. Start with one document and one practical question: who currently needs to read it, and who genuinely needs to edit it?
Begin with a manageable sample
Choose five files from completed activities rather than auditing an entire cloud drive at once. For each, record the owner, purpose and necessary participants. Distinguish viewing from editing. This gives you a reason for each decision before changing any permissions.
Do not begin by reorganising someone else’s shared work folder. Documents belonging to an employer or school are governed by their arrangements; ask the owner when uncertain. Access that appears unnecessary from one participant’s perspective may still support another person’s work.
Review people and links separately
Microsoft’s OneDrive and SharePoint guidance distinguishes direct access, sharing links and permissions inherited through a folder or site. Checking only the last link you sent is therefore insufficient. Open the file’s access management view and examine the different ways recipients can reach it. The exact controls depend on the account and organisation settings.
For example, a classmate may have a personal invitation and also belong to a shared folder. Removing the invitation may leave the other route available. When closing collaboration, check the overall access picture for the document, not just one message or invitation.
Share the smallest useful unit
If someone needs one PDF, consider whether sharing the entire folder is appropriate. The folder may contain drafts, named notes or documents added later. Where helpful, prepare a separate copy for sharing and give it a filename that makes the version clear to the recipient.
Inspect the content too: comments, hidden sheets and attachments may not be intended for the reader. A restricted link does not remove information accidentally left in the document itself. Ending cloud access also cannot retrieve a separate copy that the recipient has already saved.
Check the recipient’s experience
Open the link in a signed-out browser window if you want to check whether it is publicly accessible. That test does not establish that every named permission is correct; ask the intended recipient to try with their own account. Testing does not require another person’s password.
Record the event that should trigger the next review, such as the end of a course or a project handover. A clear owner and a checked access list are more useful than a collection of “final-final” filenames. Sharing then becomes a small deliberate decision, rather than an old link remaining open indefinitely through habit.
Sources
Prepared 1 November 2026. The image is an AI-generated illustration.