Sharing a document with a client should be straightforward. Knowing who can still reach it six months later takes ownership and review. Use this guide to scope an external-sharing review with your MSP, beginning with one real workflow and ending with evidence that approved collaboration still works.
Start with a business workflow and a named owner
Choose a defined activity: exchanging drafts with a client, collecting information from an outside adviser, or collaborating with a project partner. Record the information involved, expected recipients, required editing rights, and the date the collaboration should end. The business owner decides who needs the information; the MSP implements and checks the approved access.
Illustrative example: a consulting team invites an outside reviewer for a six-week engagement. The review should identify the project location, the sponsor responsible for access, and the closure date. It should also ask whether the reviewer needs one document, a folder, or membership that exposes a wider workspace. Keep the example separate from any claim about a real client.
Distinguish the link from the permission
Microsoft documents several sharing-link behaviors. An Anyone link can allow access without authentication, and possession of that link matters. A Specific people link is intended for the named recipients. A link for people with existing access helps someone reach an item without granting new permission by itself.
These distinctions affect what you should review. Seeing a familiar recipient on one link does not establish that no other access route exists. Ask the administrator to examine relevant links, direct permissions, and group membership together. The same file may be reachable through more than one route.
| Access route | Business question | Review action |
|---|---|---|
| Anyone link | Is unauthenticated access appropriate for this material? | Confirm justification and remove unnecessary links |
| Specific people link | Are all named recipients still involved? | Confirm recipients and intended rights |
| Existing-access link | Where does the underlying permission come from? | Review direct or inherited access |
| Group or workspace membership | Does membership expose more than the intended file? | Review membership and workspace scope |
Review settings at the levels that govern the work
Microsoft explains that organization and site sharing controls work together, and that Microsoft Entra external collaboration settings also affect guest sharing. Have the MSP explain the effective configuration for the chosen site or OneDrive rather than presenting only a tenant-wide screenshot.
Decide which workspaces need external collaboration and which should have narrower boundaries. Ask which link type users receive by default and who may invite guests. Record required changes and their expected effect before applying them. A broad restriction can interrupt legitimate work, so the business needs a communication and validation plan alongside the technical setting.
Use a small access register that someone will maintain
For each reviewed collaboration, record the owner, workspace or item, external recipients or group, purpose, permission level, next review date, and closure action. Keep sensitive details in an approved internal system. A public spreadsheet of document URLs and client identities creates another information-handling problem.
Start with active and recently completed projects that involve sensitive business information. Ask owners to confirm continued need rather than relying only on whether an account has signed in. An infrequent adviser may still need access; an active guest may have moved to a different assignment. Automated reporting can support the decision, but the business purpose must come from an accountable owner.
Test the change without exposing real information
Use an approved test document containing no client or employee information. Check the intended recipient experience and an unauthorized test identity. Confirm both the access that should work and the access that should be denied. Have the administrator explain any inherited permissions that affect the result.
After removing an unnecessary link or membership, check whether other permissions still provide access. Revoking access does not retrieve copies someone already downloaded, so treat prevention and information handling as separate responsibilities. Keep a concise record of the change, test result, reviewer, and remaining issues instead of calling the review complete when a setting is saved.
Close projects and carry the review into normal service
At project closure, ask the owner to confirm which outside collaborators still need access and why. Remove access routes that are no longer authorized, preserve business records according to the organization’s requirements, and record exceptions with a next review date. Do not delete records merely to make an access report look cleaner.
Bring overdue reviews, ownerless workspaces, and unresolved sharing exceptions to the regular MSP service review. Ask whether any proposed automation requires additional licensing and who will operate it. A modest review process that owners actually complete is a better purchasing requirement than an unattended dashboard.
Working checklist
✓Name a business owner and define the collaboration’s purpose.
✓Review links, direct permissions, and group membership together.
✓Confirm the effective sharing settings for the selected workspace.
✓Test intended and denied access with harmless test content.
✓Record project closure, exceptions, and the next review date.
Sources and further reading
Primary references for the topics identified below. Examples, checklists, and purchasing recommendations are editorial guidance.
- Microsoft: Overview of external sharing in SharePoint and OneDrive ↗
Explains external-sharing options and how SharePoint, OneDrive, and external collaboration settings interact. Checked November 9, 2026.
- Microsoft: Sharing and permissions in the modern experience ↗
Describes link types and permission behavior. Used for the distinctions between Anyone, Specific people, and existing-access links.
- Microsoft: Manage sharing settings ↗
Documents organization-level sharing controls and their relationship to other settings. Confirm the configuration in your own tenant.
Published by Bay Area Managed IT. Examples are illustrative; they are not provider quotes, audited results, or local market survey findings. Read our editorial approach →
Keep ownership visible after the configuration work.
Use the monthly service review to resolve overdue access decisions and confirm who owns each action.
Plan the next service review