If you want to share files securely from SharePoint, the answer is straightforward: stop sending email attachments and start using SharePoint’s built-in sharing links instead. SharePoint lets you send a link to any file or folder, control exactly who can access it, set an expiry date, and revoke access at any time. This guide walks you through the right way to do it.

Why Emailing Attachments Is a Problem

Sending a file as an email attachment creates multiple copies of the same document. The recipient downloads their version, makes changes, and sends it back. Meanwhile, someone else has already updated the original. Before long, no one is certain which version is correct.

There is also a security problem. Once a file lands in someone’s inbox, you have no control over what they do with it. They can forward it to anyone, save it anywhere, and you will never know. If that file contains client data, financial information, or anything sensitive, that is a real risk.

SharePoint solves both of these problems. There is one version of the file, stored in one place, and you control who can see it and when that access ends.

How to Share a File or Folder from SharePoint

Sharing from SharePoint takes about thirty seconds once you know where to look. Follow these steps to do it properly.

1. Open SharePoint and navigate to the file or folder you want to share.
2. Right-click the file name, or select the three dots (more options) next to it.
3. Click Share from the menu that appears.
4. A sharing panel will open. This is where you choose who gets access and what they can do.
5. Add the names or email addresses of the people you want to share with.
6. Choose the permission level: Can view or Can edit.
7. Add an optional message if you want, then click Send.

The recipient gets an email with a link to the file. They click through and see the live version, not a frozen copy.

Understanding the Three Link Types

Before you send a link, you need to choose who can use it. SharePoint offers three options, and picking the right one matters for both convenience and security.

Anyone with the link

This is the most open option. Anyone who receives the link can open the file, even if they do not have a Microsoft account. Use this for public-facing documents like brochures or event information. Do not use it for anything confidential. This link type should always include an expiry date.

People in your organisation

This option limits access to people who are signed into your company’s Microsoft account. It is appropriate for internal documents, team resources, and anything you would share with colleagues but not external parties. It is safer than the Anyone link and still easy to use for your team.

Specific people

This is the most secure option. Only the exact people you name can open the link. Everyone else is blocked, even if they somehow get hold of the URL. Use this for anything sensitive, including client documents, contracts, HR information, or financial records.

As a general rule, default to Specific people for anything confidential. If you are unsure which to use, your IT team can help you set the right defaults. Otto IT’s managed cyber security services include guidance on SharePoint sharing policies for your organisation.

How to Set an Expiry Date on a Shared Link

One of the most underused features in SharePoint is link expiry. You can set a date after which the link stops working automatically. This is ideal for external sharing, short-term projects, or any situation where access should be temporary.

To set an expiry date, open the sharing panel and click Link settings or the gear icon. You will see an option to set an expiration date. Choose a date that makes sense for your situation, and SharePoint will handle the rest. The link stops working once that date passes, without you needing to remember to revoke it manually.

View-Only vs Edit Permissions

When you share a file, you also choose what the recipient can do with it. Getting this right is important.

Can view means the recipient can read the document but cannot make any changes. Use this when you want someone to review or reference a file without altering it. It is the right choice for most external sharing situations.

Can edit means the recipient can open the file and make changes directly. This is useful for collaboration, but think carefully before granting it to external contacts. Once someone can edit, they can also delete content or overwrite work.

If in doubt, start with view-only. You can always upgrade access later if needed.

How to Check Who Has Access to a File

It is good practice to review file access periodically, especially for important documents. SharePoint makes this easy to check.

Navigate to the file in SharePoint, right-click it, and select Manage access. You will see a list of everyone who currently has access, along with their permission level and how they were granted access. This gives you a clear picture of your file’s exposure.

How to Revoke Access

When someone leaves the project, changes roles, or no longer needs a file, you should remove their access promptly. Leaving unnecessary access in place is a common security gap.

To revoke access, open Manage access for the file. Find the person or link you want to remove, click the three dots next to their name, and select Remove access. For shared links, you can also click Stop sharing to disable the link entirely. The change takes effect immediately.

How Microsoft Copilot Can Help

If you have Microsoft 365 Copilot, it can make the sharing process even smoother in a couple of practical ways.

When you are sharing a file with an external contact, Copilot can draft the accompanying message for you. Just tell it who the recipient is and what the document is about, and it will write a professional covering note in seconds.

Copilot can also summarise long documents for recipients who need a quick overview before reading in full. Instead of asking someone to wade through a lengthy report, share the file and ask Copilot to write a two-paragraph summary they can read first. This is particularly useful for client-facing documents or board papers.

Make Secure Sharing the Default

Most security incidents do not involve sophisticated attacks. They happen because someone emailed a file to the wrong person, or a link stayed active longer than it should have. SharePoint’s sharing tools are designed to prevent exactly that, but only if your team knows how to use them.

If you want to build better file sharing habits across your organisation, or if you need help configuring SharePoint permissions to match your security requirements, we can help. Get in touch with the Otto IT team or book a call to talk through your setup.

Frequently Asked Questions

Can I share SharePoint files with people outside my organisation?

Yes, you can share files with external contacts using the Anyone or Specific people link options. For security, use Specific people and set an expiry date on the link. Your IT team may also have policies that restrict external sharing at the organisational level.

What happens if I accidentally share a file with the wrong person?

You can revoke access at any time through Manage access in SharePoint. Find the person or link, select Remove access, and the change takes effect immediately. Act quickly if sensitive information was involved and let your IT team know.

Is SharePoint sharing compliant with privacy regulations?

SharePoint is built on Microsoft 365 infrastructure, which meets a wide range of compliance standards. However, compliance also depends on how you configure sharing settings and whether your policies align with regulations like the Australian Privacy Act. Your IT provider can help you review this.

Do I need a Microsoft account to access a shared SharePoint file?

It depends on the link type. Anyone links work without a Microsoft account. Specific people and People in your organisation links require the recipient to sign in with a valid Microsoft account.

How long does it take to revoke SharePoint access?

Access revocation in SharePoint takes effect immediately once you confirm the change. There is no delay or waiting period.