A junior associate at a Mississauga law firm needed to send a closing package to opposing counsel. She grabbed the file from OneDrive, hit share, and picked the first option that appeared: a link that works for anyone who has it, no sign-in required.
It’s the kind of moment that plays out inside GTA offices every day, often through the same everyday cloud file-sharing tools that keep a business running.
The problem is what happens afterward. Unless the link is set to expire or someone removes access, it can remain active long after the deal closes. Anyone who obtains the link may still be able to access the document, leaving an exposure that could go unnoticed until someone reviews the organization’s Microsoft 365 sharing settings.
Why “Anyone” Links Become the Default Nobody Chose
Microsoft 365 gives users several ways to share a file or folder: with specific people, people who already have access, anyone inside the organization, or anyone with the link. That last option requires no sign-in or verification. If someone has the URL, they can open the file.
The setting that decides which option appears first is buried in the SharePoint admin center, and many small businesses never think to change it.
If “Anyone with the link” is the default, it can easily become the one-click choice. Staff aren’t necessarily being careless. They’re busy, they need to send a file, and they use the option already sitting in front of them.
Outlook can make things just as easy to overlook. When someone shares a OneDrive or SharePoint file instead of attaching a copy, Outlook can send a cloud-sharing link. What access that link provides depends on the organization’s sharing settings and the permissions applied when it is sent.
Most employees aren’t going back later to check who still has access. That is how old sharing links can quietly pile up.
One IT provider found more than 35,000 active anonymous links while auditing the OneDrive environment of a Microsoft 365 tenant with about 3,000 users.
That’s a lot of forgotten links. Multiply routine file sharing across a few years and dozens of employees, and it’s easy to see how accidental exposure can add up.
Why This Matters Under Canadian Privacy Law
An exposed OneDrive link isn’t just an IT headache. If it gives someone unauthorized access to personal information, it can become a privacy breach with legal obligations attached.
Under PIPEDA, organizations must report breaches that create a real risk of significant harm to the Office of the Privacy Commissioner of Canada. They must also keep records of all breaches involving personal information, even those that don’t meet the reporting threshold.
And it doesn’t take a hacker to cause a breach. An old sharing link that leaves sensitive information accessible to the wrong person can be a privacy breach.
Regular IT compliance reviews that include Microsoft 365 sharing settings can help GTA businesses find those gaps before they become a larger privacy problem.
What a Sharing Audit Actually Turns Up
Most businesses assume their file sharing looks tidy until they actually check. A proper audit usually finds the same handful of problems.
Files still open to people who left the company
When an employee leaves, disabling their account doesn’t necessarily clean up every file or folder they shared with someone outside the business. Pairing a Microsoft 365 sharing audit with a solid offboarding checklist helps catch lingering access before it is forgotten.
Links with no expiration date
Older “Anyone” links often have no expiration date at all. A file shared for a single project in 2023 can still be accessible in 2026, long after everyone inside the business has forgotten about it.
Folders shared more broadly than intended
Sharing an entire folder instead of a single file can expose much more than intended. Depending on the permissions and folder structure, people may end up with access to files added later or content the person sharing never meant to include.
Running the Audit Without Slowing Everyone Down
A Microsoft 365 sharing audit doesn’t have to disrupt a busy office. The goal is to find risky access, clean it up, and make safer sharing easier going forward.
Start by reviewing SharePoint and OneDrive permissions and sharing activity to find sites, files, and folders with broad or external access.
Then prioritize what matters most. Client files, financial records, HR documents, and other sensitive information should move to the top of the list.
Next, review the organization’s sharing settings so employees see “Specific people” as the default, while still keeping “Anyone” links available when there’s a legitimate reason to use them.
Finally, put an expiration policy on “Anyone” links that still serve a legitimate purpose. That way, temporary access doesn’t quietly turn into permanent access.
The idea isn’t to make sharing harder. It’s to make the safer choice the easiest one.
Ready to See What’s Actually Being Shared?
Anonymous links are easy to create and even easier to forget. A Microsoft 365 sharing audit can uncover outdated links, overly broad permissions, and sharing settings that leave more information accessible than intended.
Data First Solutions can review your Microsoft 365 environment, identify unnecessary external access, and help you tighten sharing settings without making everyday collaboration harder for your team. We can also help put safer defaults in place so the same problems don’t keep coming back.
Contact our team to book a Microsoft 365 sharing assessment, or call 416-412-0576 to talk through what an audit would involve for your business.
Article FAQs
What is an “Anyone” link in Microsoft 365?
It’s a sharing link that grants access to whoever has the URL, with no sign-in or identity check required. Anyone who receives, forwards, or finds the link can open the file.
How do I know if my business has anonymous sharing links active?
A SharePoint administrator can review sharing and permissions reports to identify anonymous links and other external access across SharePoint and OneDrive. A broader audit can then determine which links and permissions are still necessary and which should be removed.
Does turning off anonymous sharing break normal collaboration?
No. Switching the default to “specific people” still allows sharing with named colleagues, clients, and vendors. The difference is that recipients are identified rather than giving access to anyone who happens to have the link.
