Cleaning Up "Anyone With the Link" Shares in OneDrive and Drive

Why "anyone with the link" sharing is risky

Link sharing is convenient: no guest accounts, no sign-in prompts for the client. The trade-off is that the link is the only key. Microsoft describes Anyone links as letting people access files and folders without authenticating, and links that are forwarded keep working.

• Forwarding: a client forwards your email to a supplier, who forwards it again.
• No record of who opened it: you can see the link was used, not reliably by whom.
• Old links never die: a quote folder shared in 2022 may still be open, now containing newer files.
• Folder links grow: sharing a folder shares everything added to it later.
• AI assistants: tools such as Copilot and ChatGPT connectors respect permissions, so loose sharing inside the company also widens what they can surface. See our guide on Copilot oversharing in SharePoint.

Under the PDPA, a file of customer details left open to anyone with the link is the kind of exposure that leads to a breach notification. Cleaning it up is cheap; explaining it later is not.

Find Anyone links in SharePoint and OneDrive

Microsoft gives you two ways to see what is shared, depending on your licence.

1. 1

   Run the site sharing report

   As a site admin, open the SharePoint site (or a user's OneDrive), go to Settings > Site usage and create a sharing report. Microsoft's sharing reports page says it produces a CSV of every unique file, user, permission and link on the site.

2. 2

   Save the report somewhere private

   The CSV is saved to a location on the site. Microsoft suggests a folder only site owners can open, so members do not see the list of shared files.

3. 3

   Filter for Anyone links

   Open the CSV in Excel and filter the link type column for Anyone. Sort by folder so you can see which client or project areas are most exposed.

4. 4

   Check tenant-wide activity if you have it

   With SharePoint Advanced Management, the data access governance sharing links report lists the sites where the most Anyone links were created in the last 28 days.

5. 5

   Remove or replace links

   For each file or folder, open Manage access, delete the Anyone link, and if the person still needs it, share again with Specific people.

For a small business, start with the shared sites holding finance, HR and client files, then each director's OneDrive, which is where most ad-hoc sharing happens.

Change SharePoint and OneDrive sharing defaults

Cleaning up once does not help if every new share is public by default. In the SharePoint admin centre, go to Policies > Sharing. Microsoft's external sharing settings page explains each option.

Microsoft notes that if you shorten the expiry, existing links keep their current expiry only if it is shorter than the new setting, so a stricter rule also tightens older links. If you switch off Anyone links entirely, existing Anyone links stop working, so warn staff and clients first.

Sites can be stricter than the organisation. Put HR and finance sites on Only people in your organisation, and allow guests only on project or client sites.

Find and fix public links in Google Drive

Google Workspace works on the same idea, with different menus. Admins control sharing in the Admin console under Apps > Google Workspace > Drive and Docs > Sharing settings.

• Limit sharing outside your organisation: Google's external sharing help says that with external sharing on you can still warn users before they share, or block link sharing.
• Allowlisted domains: if you share mainly with a few partner companies, allow sharing only with those domains.
• Find files made public: in Reporting > Audit and investigation > Drive log events, filter on visibility changes to see files set to anyone with the link, who owns them and when it changed (Drive log events help).
• Fix each file: the owner opens Share, sets General access to Restricted, and adds the people who need access by email.
• Keep the external warning on: Google shows an External label on files shared outside the organisation by default. Leave it on so staff notice.

A monthly sharing-link check

Sharing creeps back. A 20-minute check each month keeps it under control and gives you evidence for audits such as CSA's Cyber Essentials.

Guest accounts deserve the same treatment. Our quarterly access review checklist covers removing leavers and old guests, and our guide to Teams external access and guests covers chat and meeting access.

How to share with clients safely instead

Staff use Anyone links because they are easy. Give them an equally easy alternative.

If you are choosing between platforms, our Google Drive vs OneDrive vs Dropbox comparison covers how each handles external sharing and guest access.

Do it yourself or get help?

A small team can run the reports and change defaults in an afternoon. The slow part is the first clean-up, when hundreds of old links need an owner's decision, and keeping the monthly review going.

Our Microsoft 365 / Google Security Lockdown (S$590) sets sharing defaults, link expiry and guest rules as part of a wider security baseline. For a repeatable monthly report of public links, guests and leavers across your tenant, see the Access Review & Leaver Tool (from S$1,200).