External sharing in Microsoft 365: collaboration without leaving access open

A customer needs the latest quotation, your accountant needs a receipt and a supplier needs project documents. Creating a sharing link is easy. Three months later, the harder question is who can still open, edit or pass on those files. IT may know the settings without knowing the business reason behind each individual permission.

External collaboration is everyday work for Swiss SMEs. Banning it outright rarely solves the problem: people find other routes. We recommend a manageable sharing model with a few clear rules, appropriate document locations and someone responsible for ending access. The most important decision comes before pressing Send: how much access does the other person actually need?

This guide uses Microsoft documentation checked on 7 October 2026. The suggested review intervals, responsibilities and implementation steps are ZUMENTIQ recommendations, rather than mandatory product defaults or claimed customer results. Its focus is the specific routes through which outsiders receive information, rather than a general Teams cleanup.

A sharing link does not always mean the same audience. Microsoft’s sharing settings documentation explains that Anyone links work without authentication. A recipient can pass the link on. For confidential collaboration, our recommended starting point is named recipients and the smallest practical scope.

Microsoft describes named-recipient verification in its secure external sharing documentation. Depending on the sharing model, recipients use an account or a code. An email verification code is not automatically equivalent to deliberately configured multifactor authentication. Test the actual recipient experience using an external test account.

This table supports decisions rather than ranking every possible situation. A public product brochure needs different rules from an editable costing spreadsheet. Someone who only needs to read an approved PDF should not automatically become a member of an entire project team. Match information needs with the work being done.

Teams guest access supports collaboration in teams and on channel files. Microsoft distinguishes it from external access for chats, calls and meetings. A successful chat with a partner does not establish that they can access your project files. Equally, adding a guest is more than inviting someone to a single conversation.

A shared workspace can make sense for a regular project partner. Deliberately assemble the documents they need. A narrowly scoped file share may be enough for a one-off question about a quotation. Decide on the work first, then choose between membership, a folder or a document.

Also define where internal work continues. Keeping confidential calculations beside the customer version makes sharing decisions harder. A separate external collaboration area can simplify them. Before reorganising files, check existing references and workflows so that a clearer permission model does not disrupt necessary work.

Microsoft’s external sharing overview explains how organisation and site settings interact: the more restrictive limit applies. An individual SharePoint site cannot allow broader sharing than the organisation permits. OneDrive can be equally or more restrictive than SharePoint. Teams, groups and identity management introduce additional dependencies.

The practical architecture question for an SME is which workspaces support outsiders and which remain internal. Start with two or three understandable use cases. An HR document area and a shared supplier workspace need different rules. Record exceptions so that a deputy can explain them later.

IT should verify effective access rather than merely capture a screenshot of a switch. Acceptance includes a test as the intended recipient and another as an unauthorised person. Blocked sharing also needs a support route. Otherwise, a technically correct restriction may lead to private uploads or additional copies in everyday work.

A review date means someone must decide whether access is still needed. A technical expiry date limits a particular access route. Removing one share does not necessarily remove every other permission held by that person. Put these distinctions in the working instructions so that an email reminder is not mistaken for completed revocation.

Microsoft documents configurable expiry limits for Anyone links. That does not establish a universal expiry period for every guest identity. Microsoft also notes that leaving a team does not automatically remove a guest from the directory. Make separate decisions about individual shares, memberships and whether the identity remains necessary.

Revoking access does not automatically retrieve copies already downloaded. Decide beforehand which information may leave the organisation. Particularly sensitive material needs a separate business decision about recipients, processing and appropriate safeguards.

The following matrix proposes an operating model. Adapt it to your information and partners. Its value lies in giving each situation a clear next action. Employees should recognise the appropriate row without understanding every administration portal first.

For recurring cases, provide a template covering purpose, recipient, location, permission and review date. The business owner decides on need; IT implements technical boundaries and supports exceptions. Accountability should not depend on who happened to create the link first.

For ordinary documents, start with view access unless editing is necessary. This is our recommendation, not a claim about your tenant’s defaults. Employees must recognise and adjust the sharing dialog choices. Demonstrate the process with an actual exercise using a customer version and an internal working document.

Microsoft Entra Access Reviews can support recurring reviews of group membership and application access. Microsoft lists Entra ID Governance or Entra Suite as licensing requirements, with some capabilities available under Entra ID P2. The appropriate option depends on the review scope. An existing Microsoft 365 subscription does not confirm entitlement to every governance capability.

A group membership review is also not a complete inventory of anonymous links and individual file permissions. Define the access routes your control needs to cover first. Then decide whether automation addresses the task or additional steps are necessary.

For a small number of partners, manual reviews may be economical: prepare a list, ask owners to decide, implement changes and verify the result. Reserve actual calendar time. A simple process that gets completed is more valuable than an elaborate capability whose notifications nobody handles.

Week one: select ten real sharing cases from different departments. Record recipient, purpose, content, access route and accountable owner. Include a long-standing partnership and a collaboration that has already ended. The aim is to understand actual working practices rather than judge employees prematurely.

Week two: agree the sharing matrix and check effective settings with IT. Identify internal document areas that do not need outsiders. Prepare a brief help page with two examples and a support contact. Changes to widely used settings require agreed testing and communication with affected users.

Week three: correct approved cases. Test viewing, editing and ending a share using suitable test data. Include a forwarded link and an attempt with the wrong email address. Document any other access routes remaining after revocation. Acceptance covers both successful collaboration and effective boundaries.

Week four: ask business owners to confirm outcomes. Schedule the next cycle, perhaps quarterly and additionally at project completion. These intervals are suggestions; higher-risk or shorter collaborations need different dates. Assign unresolved cases a decision maker and deadline. An unclear response must not silently count as completed.

A hypothetical effort estimate: twelve owners spend twenty minutes each reviewing their shares. That totals four hours, plus preparation and implementation. This is not a savings promise. It makes review work visible in the budget and allows comparison with the value of the information involved.

Measure the proportion of reviewed shares with a confirmed purpose and reachable owner. Track overdue decisions and sample whether revoked access actually ends. The total number of guests is not a useful success metric on its own: many well-managed partnerships can be healthier than a few unexplained exceptions.

Listen to support requests too. Repeated problems with recipient addresses, invitations or editing permissions reveal gaps in guidance. Add a targeted example rather than another rule. Explicitly transfer responsibility for external sharing when staff change roles. A departing project lead should not leave permanently unanswered access questions behind.

Imagine a small construction business preparing a refurbishment quotation. The customer needs to read the scope, an external designer needs to add technical details, and the internal team needs to discuss margin. These tasks concern the same project but require different information and permissions. One large folder for everyone would be convenient while mixing distinct decisions together.

Our suggested approach is to share a clearly scoped customer version with the named recipient. Define an appropriate shared area for technical coordination. Keep internal pricing calculations and confidential comments in the internal document area. The project lead records which version is authoritative and when sharing will be reviewed after the decision.

A rejected quotation also needs closure. Is there still a legitimate reason for access, such as an agreed follow-up question? If so, record it with a new review date. Otherwise, remove the relevant access and test the result. This is a business decision, rather than automatically treating rejection as an instruction to delete everything.

The example also shows the limits of technical controls. A correctly addressed link can still expose the wrong information. Include a brief content check: is this the intended version, are attachments and comments appropriate, and does the scope match the agreed purpose? That check is part of sound collaboration.

External sharing is a business decision implemented through technology. Named recipients, appropriate scope and a verifiable end provide a sensible starting point. Not every collaboration needs an entire workspace, not every old guest should be deleted indiscriminately, and not every review requires additional software.

Start with ten shares this week. If you can explain why each exists, who decides and how access ends, you have made practical progress. Recovery needs a separate strategy; see our Microsoft 365 backup guide.