How to Share OneDrive Files Safely with Clients Without Exposing Company Data

Sharing files with clients via OneDrive is efficient — but the default settings can be dangerously permissive.

A client asks for the proposal you mentioned in the meeting. Instead of attaching a large file to email, you share a OneDrive link. They click it, and can now browse your entire company drive — every file your whole team has ever worked on.

This scenario happens more often than you'd think, because OneDrive's default sharing settings are configured for convenience, not security. Here's how to share exactly what you intend to share, and nothing more.

Two Fundamentally Different Sharing Approaches

Before configuring anything, understand the two approaches:

Share a specific file or folder: Right-click a file → Share → generate a link for that item only.

Share your entire drive (accidentally): If you share your root OneDrive folder, recipients get access to everything in it.

Never share your root OneDrive folder. Always navigate to the specific file or subfolder you want to share.

Understanding Link Types

When you click "Share" in OneDrive, you'll see link permission options:

Link Type	Who Can Access	Best Use
Anyone with the link	Anyone who receives the link	Only for fully public, non-sensitive content
People in your organisation	Colleagues with your company's Microsoft 365 accounts	Internal sharing only
Specific people	Only the email addresses you explicitly enter	Client sharing — most secure option
Existing access	People who already have permissions	No change to current access

For sharing with clients: always choose "Specific people" and enter their email address. This way, even if they forward the link to someone else, that person cannot access the file.

Setting Expiry Dates on Shared Links

Shared links that never expire create ongoing risk. A client changes jobs, the project ends, but the link still works indefinitely.

How to add an expiry date:

1. Right-click the file in OneDrive → Share
2. Click the settings icon (pencil/gear) next to the link type
3. Set an expiry date — 14-30 days works for most business use cases
4. After the date, the link automatically stops working

For contracts, proposals, and project deliverables, set the expiry to match the project timeline or 30 days after final delivery.

Adding a Password to Shared Links

For particularly sensitive documents, add a password to the link. Even if forwarded, the recipient needs the password to access the file.

How:

1. Right-click file → Share → Settings icon
2. Enable "Set password"
3. Send the password separately from the link (via phone call, SMS, or separate email)

Note: Link password protection requires Microsoft 365 Business Standard plan or higher. It's not available on Business Basic.

View-Only vs. Edit Permissions

When creating a link, specify whether recipients can edit:

• View only: Clients can read and optionally download the document, but cannot change your version
• Can edit: Clients can modify the document directly — risky for final deliverables you don't want changed

For documents sent for approval or review, use view only. For actively collaborative work like a shared project tracker, edit access may be appropriate — but limit to specific named people.

Preventing Downloads

If you need to share content that shouldn't be saved locally:

1. Right-click file → Share → Settings icon
2. Select "Can view" and enable Block download

This allows viewing in the browser only, preventing saves or prints. Useful for sensitive proposals under negotiation, confidential reports shared for reference, or draft documents.

Sharing Multiple Files: Use a Dedicated Client Folder

When you need to give a client access to several files (deliverables, reports, project assets):

1. Create a dedicated folder in OneDrive: Clients / [Client Name] / [Project Name]
2. Put only what they need in that folder
3. Share that specific folder using "Specific people" permissions

This approach keeps client-facing files organised and prevents accidentally sharing unrelated internal documents.

Auditing What's Currently Shared

Most businesses have forgotten shared links from past projects that are still active. This is a silent security risk.

For individual users:

1. Go to onedrive.live.com
2. Click Shared in the left sidebar
3. Review files you've shared and remove access where it's no longer needed

For IT administrators:

• SharePoint Admin Center → Reports → Sharing activity
• Shows externally shared files across the entire organisation

Do this audit at least quarterly. Remove access for completed projects.

Removing Client Access After a Project Ends

When work is complete and the client no longer needs access:

1. Navigate to the shared file or folder in OneDrive
2. Right-click → Manage access
3. Under Links, find the shared link
4. Click the three dots → Remove link (or set an expiry if you haven't already)
5. For direct user access: find their name under Direct access → Remove

Set calendar reminders when you create links — remove access at project completion, not whenever you remember.

Organisation-Wide Sharing Controls (For IT Admins)

Administrators can set defaults that make safe sharing the default for all users:

In SharePoint Admin Center → Policies → Sharing:

• Set external sharing to "Existing guests" or "New and existing guests" (not "Anyone")
• Set default link type to "Specific people"
• Require expiry dates for all external links (maximum 30 or 60 days)

These settings protect against accidental over-sharing across the whole organisation.

Practical Habits for Client File Sharing

• Use a clear naming convention: [ClientName]_[Project]_Proposal_v2.pdf — easier to track and audit
• For ongoing client relationships, use SharePoint (your team site) rather than individual OneDrive — better for managing access as team members change
• Brief your team on correct sharing procedures — most data exposure incidents are accidental
• Never use a personal Microsoft account for business file sharing — those files aren't under company control or backup policies

Vietify Can Help

If your organisation's OneDrive or SharePoint sharing settings aren't properly configured — or you're concerned about data that may have been over-shared — Vietify can review and tighten your Microsoft 365 data sharing policies.

Contact us → or get a free IT assessment.

Vietify IT Services — Microsoft 365 security and file management for businesses in Vietnam.