You shared a folder with a contractor in 2023. The project wrapped, the invoice cleared, and everyone moved on.
The link didn’t.
Unless someone went back and turned it off, that link is live right now. It still opens the folder. And the odds are good that nobody at your company has looked at it since the day it was created.
This is one of the most common problems we find when we audit a new client’s Microsoft 365 tenant, and it’s almost never the result of anyone doing anything wrong. It’s just what happens when a convenient feature has no expiration date attached to it.
Why This Piles Up So Quietly
Every time someone in your business clicks Share in SharePoint or OneDrive, Microsoft creates a link. By default, that link never expires. It works until a person deliberately goes back and revokes it.
Multiply that by every employee, every quarter, for several years. Nobody’s job description includes “audit old sharing links,” so nobody does it. The pile just grows.
It helps to know that not all links are the same. There are three kinds, and they fail in different ways:
“Anyone with the link”
No sign-in required. Anyone who has the URL can open the file — forwarded in an email, pasted into a group chat, sitting in a former employee’s browser history. This is the one that should worry you most.
“People in your organization”
Requires a sign-in, which sounds safe, and mostly is. But it means any current employee — including the people you hired two years after that link was created, and the seasonal staff, and the person who’s about to give notice.
“Specific people”
The safest of the three, because it’s tied to named individuals. Still worth reviewing when someone leaves or a vendor relationship ends.
The 20-Minute Cleanup
You don’t need a project plan for this. You need one focused block of time and admin access. Here’s the order we’d do it in.
1. See what your tenant allows today
Sign in to the SharePoint admin center and find the sharing policies — they live under the Policies section. Most small business tenants we look at have never had these settings touched since the day the tenant was created.
Look at two things: what kind of external sharing is permitted, and whether any expiration is enforced. Don’t change anything yet. Just look.
2. Make “Anyone” links expire
In that same sharing settings page, there’s an option requiring “Anyone” links to expire within a set number of days. Turn it on. Thirty days is a reasonable starting point for most businesses — long enough for a real project handoff, short enough that a forgotten link stops mattering fairly quickly.
While you’re there, you can also default new “Anyone” links to view-only instead of edit. That single change prevents a surprising number of accidents.
3. Make internal links expire too
This part is new, and most businesses don’t know it exists yet. Until early 2026, “People in your organization” links simply lived forever, with no way to enforce a limit. Microsoft announced tenant-level expiration for those links in March 2026 and finished rolling it out to commercial tenants by late May.
The catch: there’s no button for it. As of this writing it’s PowerShell only, with no interface in the admin center. Using the SharePoint Online Management Shell, a maximum of 60 days with a suggested 30 looks like this:
Set-SPOTenant -CoreOrganizationSharingLinkMaxExpirationInDays 60
Set-SPOTenant -CoreOrganizationSharingLinkRecommendedExpirationInDays 30
Set-SPOTenant -OneDriveOrganizationSharingLinkMaxExpirationInDays 60
Set-SPOTenant -OneDriveOrganizationSharingLinkRecommendedExpirationInDays 30The first pair covers SharePoint sites, the second covers OneDrive. Accepted values run from 7 to 730 days, and you’ll need a current version of the management module. If that paragraph made your eyes glaze over, this is a fifteen-minute job for whoever handles your IT — it’s not a project.
4. Find what’s already out there
Here’s the part most articles leave out, and it’s the part that matters: expiration policies only apply to links created after you turn them on. Every link your team made before today keeps working exactly as it did. Forever.
So the policies stop the bleeding. They don’t clean up the existing pile. For that:
- Search your audit log. In the Microsoft Purview portal, run an audit search filtered to sharing activities. You’ll get a list of who shared what, when, and with whom. Export it to Excel and sort by date — the oldest entries are usually the most interesting.
- Check your crown jewels by hand. You probably have a short list of folders that would genuinely hurt: payroll, client contracts, financials, HR files. Open each one, use Manage access, and read the list of links and people. Remove anything you can’t explain.
A note on licensing, because this trips people up: Microsoft does offer a built-in oversharing report in the SharePoint admin center, but it requires SharePoint Advanced Management or an E5 license. If you’re on Microsoft 365 Business Premium — which describes most businesses we work with around Castle Rock and the Denver metro — that report isn’t available to you. The audit log route above is, and it gets you the same answers with a bit more elbow grease.
What to Check Twice a Year
Once the policies are on, this becomes maintenance rather than archaeology:
- Review sharing on your sensitive sites and folders every six months
- Add “review what they shared” to your employee offboarding checklist, alongside disabling the account
- Do the same when a vendor or contractor engagement ends
- Re-check the tenant sharing settings annually, since Microsoft’s defaults do change
Disabling someone’s account does not revoke the “Anyone” links they created. Those keep working after the person is gone. That surprises almost everyone the first time they hear it.
Where to Start
If you only do one thing this week, do step 2. Turning on expiration for “Anyone” links takes about ninety seconds and stops the pile from growing.
If you’d rather know what’s already exposed before you touch anything, that’s exactly the kind of audit Castle Rock Sky runs for Colorado businesses — we’ll pull the report, walk you through what’s shared and with whom, and set the policies so it doesn’t build back up. Get in touch and we’ll take a look at your tenant.
