Sharing Microsoft 365 files with customers: an access checklist
Before sending a customer a file, check the document, their email address, the permission they need and who can use the link. Then give someone responsibility for reviewing access when the work ends.
SharePoint external sharing lets people outside your business access agreed files. This checklist covers SharePoint Online and OneDrive for work or school in Microsoft 365. Use it for a customer handover, a working document or another clearly defined task.
1. Choose the right file and recipient
Open the approved version and check what it contains. Remove internal comments or unrelated information from the customer-facing copy as appropriate. A project folder may also contain supplier quotations, margin notes and other customers’ details, so inspect its contents before sharing the whole folder.
Check the recipient’s full email address against your known customer contact, rather than relying on autocomplete. Agree who in your business owns the document and the sharing decision.
If its long-term home is unclear, our OneDrive vs SharePoint guide helps you decide where team and individual files belong.
2. Choose the SharePoint external sharing link audience
The link audience determines who can use it. Open the link settings before copying or sending a link; the words “Copy link” do not tell you its audience.
Specific people, sometimes shown as People you choose, is a useful starting point for named customer contacts. The recipients must authenticate. Forwarding that link does not give a new person permission, although they might already have access another way.
Anyone allows whoever has the link to use it without signing in. It can be forwarded, so avoid treating it as a private invitation for confidential customer work.
People in your organisation is for people inside your business, rather than inviting an external customer.
People with existing access gives no new permission. It helps someone find an item they can already open.
Available options depend on your setup. Microsoft’s guide to shareable links explains the audience distinctions.
3. Give view or edit access to suit the task
Choose view when the customer only needs to read the finished document. Give edit access when they genuinely need to change it, ideally to the specific working file involved.
Be particularly careful with editable folders: Microsoft’s file-sharing guidance explains that folder editing can include moving, renaming, sharing and deleting contents.
View access does not automatically prevent downloading or copying. Some supported links offer a download-blocking option, depending on the account, file and settings. Do not assume that this prevents screenshots or every form of redistribution.
4. Check existing access and the recipient’s experience
Use Manage access, or ask the authorised owner or administrator to inspect it. Check existing links, direct permissions and access inherited through folders, sites or groups. Creating a restricted link leaves other permissions in place.
Ask the customer to confirm they can open the intended item and do the agreed task. Opening your own link only tests your access.
The recipient may need to sign in or use an emailed verification code, depending on the configuration. Microsoft’s external-sharing guidance describes these options. They should use their own identity; do not ask for their password or code.
5. Name the person who will review access
Record a review date or a clear trigger, such as customer acceptance or project closure. A date in your checklist is a reminder; it does not make the link expire automatically. Use expiry controls where they are available and appropriate, while keeping a named owner for the review.
When access is no longer needed, have the authorised person remove the relevant link or permission and check other access routes. Deleting one link may leave direct or inherited access intact. Microsoft’s Manage access guidance explains the different routes.
Removing access does not recall ordinary copies already downloaded. Keep the business records you need; ending external access is separate from deleting the file.
6. Ask for help if sharing is blocked
If an option is missing or the customer cannot open the file, check the intended address and ask your Microsoft 365 administrator to investigate. Avoid switching to Anyone just to make an error disappear.
Microsoft’s external-sharing settings guidance explains that organisation and site restrictions apply. Your administrator can check the business requirement and the relevant settings without opening up unrelated areas.
A customer job pack: a worked example
Imagine a small signage installer finishing a shop-front project. This is a hypothetical example. Its folder holds a handover PDF, a snagging spreadsheet, supplier quotations and internal margin notes.
The customer needs to read the handover PDF and update the snagging spreadsheet. The office manager plans Specific people links to the verified customer contact, with these permissions:
Document | Intended customer access |
Handover PDF | View the agreed finished version. |
Separate snagging spreadsheet | Edit this working file to record outstanding items. |
Supplier quotations and margin notes | No customer access. The administrator must check all existing access routes. |
Before sending, the authorised administrator checks older links and inherited permissions; separating the files alone does not settle access. The office manager verifies the customer’s email and asks them to confirm both intended actions work.
Illustrative sharing record, not a completed test:
Business owner: office manager.
Review trigger: customer acceptance of the job.
Current status: on hold until the administrator confirms the access checks; recipient confirmation remains pending until the files are shared.
The intended result is a usable handover: the customer can read the approved PDF and update outstanding items without opening the installer’s commercial working files. A colleague covering the job can see who owns access and when to review it, rather than reconstructing the sharing decision from emails.
Customer acceptance triggers the office manager’s access review. They decide what still needs to be shared, arrange removal of unneeded access and record the check. Any PDF already downloaded remains with the customer.
A sharing record your team can reuse
Copy these fields for the next customer document:
Purpose and approved document or folder: ______
Named customer recipient and verified email: ______
Required permission and reason, view or edit: ______
Link audience and existing access checked: ______
Business owner and authorised person making changes: ______
Recipient check and unresolved problems: ______
Review date or end-of-work trigger: ______
Access removed or retained, reason and date checked: ______
Keep passwords and one-time sign-in codes out of this record.
Need a clearer way to share customer documents?
Cache4 helps small businesses review their Microsoft 365 setup and ongoing management, including configuration and training.
Book a free 30-minute Discovery Call with Paul Crooks. Bring an example of how your team shares customer documents and the part you are unsure about. We’ll discuss your current setup and whether we can help.
Comments