Llamaha icon

Article

Safely sharing files externally

Click-by-click steps for OneDrive, SharePoint, Box, Dropbox, and Egnyte — plus how to revoke or audit shares you've already sent. The two most common mistakes are leaving "Anyone with the link" turned on and forgetting to set an expiration. Both are 30-second fixes once you know where to click.

Pick your platform

Show steps for one platform at a time

Step-by-Step

OneDrive & SharePoint

The share dialog is identical in OneDrive, SharePoint document libraries, and files inside a Microsoft Teams channel. These steps work in the web app and from File Explorer when the OneDrive sync app is installed.

Share a file with specific people outside your company

  1. Open the file or folder. In the web app, click it once. In File Explorer, right-click the synced item.
  2. Click Share (paper-airplane icon in the web app).
  3. At the top of the dialog, click the line that currently says "Anyone with the link…" or "People in your company…".
  4. Choose Specific people.
  5. Set permission to Can edit or Can view. View is the safer default for external recipients.
  6. Turn on Set expiration date and pick a date 30–60 days out (or whenever the project actually ends).
  7. Optional: turn on Set password. Send that password through a different channel — phone, Teams chat, or text — never the same email as the link.
  8. Click Apply.
  9. Type the recipient email addresses, add a short message, and click Send. Or click Copy link if you want to paste it into your own email.

Revoke a share you already created

  1. Sign in at onedrive.com (use SharePoint if the file lives there).
  2. In the left rail, click Shared → Shared by you.
  3. Click the file or folder you want to manage.
  4. In the details pane on the right, click Manage access.
  5. To kill the entire link, click the × next to it under "Links giving access."
  6. To remove a single person, click the dropdown next to their name and choose Stop sharing.

Find every link you've ever shared (audit)

  1. Sign in at onedrive.com.
  2. Click Shared → Shared by you. This lists everything you've shared, sorted by recency.
  3. For SharePoint sites you own, open the site → gear icon → Site usage → Most popular shared content for a sharing report.
  4. Walk down the list — anything older than the project should be revoked using the steps above.

Background

Three permission options, very different outcomes

Specific people

The link works only for the email addresses you list, and the recipient must sign in to view. Best default for sensitive content. Works in OneDrive, SharePoint, Box, Dropbox, and Egnyte.

People in your company

Anyone signed in to your firm's account can open the link. Good for internal sharing where you don't need to specify each person. Not appropriate for clients or vendors.

Anyone with the link

The link works for everyone, anywhere, without sign-in. If the link gets forwarded, the new recipient can open it. Use only when content is genuinely public, and always pair with an expiration date.

Background

Old share links are quietly the biggest leak source

Set a real date when sharing externally

OneDrive, SharePoint, Box, Dropbox, and Egnyte all support expiration dates. Pick one that matches the actual project timeline — 30 or 60 days is reasonable for most external shares.

Audit your old shares once a year

Use the audit steps in each platform section above. Any share older than its project should be revoked.

If a recipient leaves their company, revoke the link

Specific-people sharing is tied to email addresses. If you shared with someone at Vendor Co. and they left, the new owner of that email can read your file unless you remove the share.

Sensitive Content

Extra steps when content is confidential

Set view-only when the recipient does not need to edit

"View only" prevents download in some apps but not all. Treat it as friction, not a hard guarantee.

Use a password on the link if available

OneDrive, Box, and Dropbox all support a password on the share link. Send the password through a different channel — phone call or Teams chat — not the same email.

Consider a request file or upload-only link

If a vendor needs to send you a file, give them an upload-only link instead of a shared editable folder. OneDrive Request Files, Box Request, and Egnyte upload-only links all work this way.

For client work, use the channel your client expects

Many clients have their own SharePoint, Box, or Egnyte they prefer. Sending into their system is often safer than sharing out from yours.

What Not To Do

Common mistakes

Don't email the file as an attachment to "make it simple"

Attachments cannot be revoked, get forwarded freely, and create version chaos. A share link can be revoked and updated.

Don't paste a "people in your company" link in an external email

The recipient sees a sign-in error and assumes the link is broken. Generate a new share targeted to their email.

Don't rely on "I sent it to a personal Gmail by mistake, can IT pull it back?"

Once a file is in someone else's mailbox or downloaded, IT cannot get it back. Slow down before sending.