Who Has Access to Your Shared Business Files? How to Find Out
Article summary: A shared file access review helps identify who can access sensitive business files, which sharing links are still active, and which permissions are no longer needed. Regular reviews help keep access aligned with current employees, vendors, and business needs while reducing unnecessary exposure.
Try a quick test. Pick the folder that holds your payroll records or client contracts. Can you name everyone who has access to it?
The obvious names may come quickly. Then come the question marks: a former bookkeeper, a consultant from two years ago, or a vendor who received a sharing link and may still have access.
Shared file permissions can accumulate quietly as employees, vendors, and business needs change. Keeping that access under control is an important part of protecting your business data.
The first step is finding out who can see what.
How Shared Folders End Up Open to Too Many People
Nobody sets out to overshare. Access usually grows one reasonable decision at a time.
Someone needs a folder for a project, so access is granted. The project ends, but the permission stays. A client receives a sharing link to review a document, and nobody checks later to see whether that access is still needed.
Common problems include:
- Temporary access that is never removed
- “Anyone with the link” sharing
- Folders shared more broadly than necessary
- Active accounts belonging to former employees or contractors
- Employees who change roles but keep their old permissions
The problem is that access rarely cleans itself up. As employees, vendors, and business needs change, permissions need to change with them.
How to Find Out Who Has Access
If your business uses Microsoft 365, you already have tools for reviewing file access.
Start With Your Most Sensitive Folders
Don’t try to audit everything at once. Start with the locations that contain sensitive information, such as payroll, HR records, client files, contracts, banking information, and tax documents.
Check Who Each Folder Is Shared With
In SharePoint or OneDrive, select a folder and open Manage access to review its sharing settings. Look at the people, groups, links, and inherited permissions that may provide access.
If you can’t explain why someone needs access, flag it for review rather than removing it immediately.
Use Microsoft’s Sharing Reports
Microsoft’s Data Access Governance reports can help administrators identify sites with potentially risky sharing patterns, including broadly shared content and sharing links.
Availability depends on your Microsoft 365 licensing, so ask your IT provider which reporting tools are included in your environment.
Review External and “Anyone” Links
Pay particular attention to old external sharing links. “Anyone” links do not require authentication and can be forwarded to other people, so they should only remain active when there is a business reason for them.
Remove or disable links that are no longer needed.
Compare Access with Your Current Team
Finally, compare what you find with your current employees, contractors, and vendors. Former employees, past vendors, and people who have changed roles are good places to look for access that may no longer be necessary.
What to Fix First
Once you know who has access, start with the permissions that no longer have a clear business purpose:
- Remove access for former employees, contractors, and vendors who no longer need it.
- Disable old or unnecessary “Anyone” links.
- Replace overly broad sharing with access for the appropriate people or groups.
- Change “Edit” access to “View” when someone doesn’t need to make changes.
- Use expiration dates for temporary sharing when appropriate.
The guiding principle is least privilege. NIST defines it as limiting access to what a person needs to perform assigned tasks.
The same principle is why employees generally shouldn’t have administrator access on their computers.
File permissions also matter when introducing AI tools such as Microsoft 365 Copilot. Copilot works within a user’s existing permissions, which means excessive access can make information available through Copilot that the employee shouldn’t have needed access to in the first place. Our guide to preparing Microsoft 365 permissions for Copilot explains why reviewing access before rollout matters.
Make the Review a Habit
A one-time cleanup only goes so far. As employees change roles, vendors come and go, and new files are shared, permissions can start piling up again.
A few simple habits can keep access under control:
- Schedule a shared file access review every quarter.
- Make access changes part of your onboarding and offboarding process.
- Assign an owner to sensitive folders who can confirm who still needs access.
Once you’ve completed the initial cleanup, these reviews should become easier to manage. Focus on your most sensitive folders, remove access that is no longer needed, and investigate anything you can’t explain.
The goal isn’t to turn file permissions into another major IT project. It’s to make access reviews a routine part of protecting sensitive business data.
Do You Know Who Can Open Your Files Today?
If you can’t confidently answer that question, it’s worth taking a closer look. Shared file access can change over time as employees, vendors, and business needs change.
Sound Computers can help you review Microsoft 365 file permissions, identify access that no longer makes sense, and clean up unnecessary sharing. We can also help you build regular access reviews into your IT routine, so permissions don’t quietly pile up again.
Contact Sound Computers to schedule a consultation. Call us at (860) 577-8060, reach us online, or email info@soundcomputers.net.
Article FAQs
How do I see who has access to a shared folder?
In SharePoint or OneDrive, select the folder and open Manage access to review its sharing settings. Access may come through individual users, groups, sharing links, or inherited permissions. Your IT provider can also help review sharing across multiple sites.
How often should I review shared file access?
A quarterly review is a practical starting point for many small businesses. You should also update access when employees or contractors join, leave, or change roles.
What is the riskiest type of sharing link?
“Anyone” links can provide access without requiring the recipient to sign in. They can also be forwarded to other people, making it harder to control who ultimately receives access. Avoid using them for sensitive information unless there is a clear business reason.
