“Send me the link” is a common request at work. But a link can be forwarded, remain in an old email or chat, and later reach someone who was never meant to see the file. With SharePoint and OneDrive, the type of link matters as much as the person you first send it to.
Three link types, three access boundaries
Anyone with the link can open the file without signing in. The link can be forwarded, and Microsoft notes that you cannot audit which individuals used it. This does not mean the whole internet automatically sees the file; access depends on obtaining the link. Source: Microsoft Learn.
People in your organisation with the link must sign in with a company account. The link will not work for external guests, but an internal colleague outside the original team may use it if they receive it. That makes it unsuitable for some sensitive information. Source: Microsoft Learn.
Specific people can open the file only as named recipients. This is useful when you know exactly who needs access, including external collaborators. You should still review whether that access remains necessary. Source: Microsoft Learn.
The default shapes everyday behaviour
If the sharing dialog offers a broad link first, people may choose it even when access for specific recipients would be enough. An administrator can change the default link type for the whole tenant or for individual SharePoint sites. Microsoft explicitly describes a setup where “Anyone” links are allowed but are not the default. Source: Microsoft Learn.
For more sensitive sites, start by asking whether external sharing is needed at all. You can tighten the settings for a particular site; do not rely only on the tenant-wide setting. Source: Microsoft Learn.
A short company checklist
- Check which link type users see by default.
- Review sites with sensitive data and their external sharing settings.
- For important files, use specific recipients and only the necessary read or edit permission.
- Review existing shares; changing the default does not inventory old links.
- Explain what each link type means. A sensible default helps, but clear rules still matter.
Sharing should be easy for people who collaborate and predictable for the company. The first step is choosing the right access boundary for each type of document.