Before you send a file link, check who can actually open it

You send a document to a colleague, then notice that its sharing panel says anyone with the link can open it. The recipient list in your message and the audience allowed by the file are separate settings. In Google Drive, an anyone-with-the-link setting permits access without a Google sign-in; a restricted file is limited to people who have access.¹

Before sending an important file, open its sharing settings. Decide who needs access and what they need to do. Then test those choices with a disposable document. You can check the process without exposing real customer records or changing a live team’s permissions.

Choose the audience before the role

Start with the people who should be able to open the document. A named recipient, everyone in an organization, and anyone who obtains the URL are different audiences. OneDrive describes these link types separately, along with a people-with-existing-access option that does not grant new permissions.²

Choose the narrowest audience that fits the work. If a colleague only needs to read a draft, begin with viewing rights. Editing is useful when they need to change the document; it is an additional decision rather than a requirement for sharing a useful link.

Google Drive distinguishes viewers, commenters, and editors. Its folder-sharing documentation also describes the operations an editor can perform within a shared folder.¹³ Review the actual item and its parent folder before selecting a role. The labels in a file service are worth reading rather than treating every share button as equivalent.

Ask different questions about each setting

The checks below correspond to the documented sharing and access-management controls in Google Drive and OneDrive. Availability can vary with the account and organization.¹⁴³²⁵

Setting	Question to answer	What to inspect
Audience	Who may use this link?	Named people, organization, or anyone with the URL
Role	What may that person do?	View, comment, or edit
Parent folder	Is there another route to access?	Inherited permissions and group membership
Download or copy controls	Which actions does the service restrict?	Available controls and their documented limits
Existing access	Who can still open the item afterward?	Direct grants, groups, folders, and other links

Read the setting as a sentence: this person can view this file because of this grant. If you cannot identify the grant, inspect the access panel before sending the link.

Check the folder as well as the file

A file can inherit access from its containing folder. Google explains that a person cannot be given less access to an individual file than the access they inherit from its parent folder in the documented arrangement.⁴³ Removing a name from one place may therefore leave another route intact.

Inspect the parent before moving a sensitive document into a shared folder. For a trial, create a harmless document in a test location and examine the access it receives. Do not use an existing confidential folder as your experiment.

Organization accounts may also limit external sharing. Google and Microsoft both document restrictions that administrators can apply.³² A missing or unavailable setting can reflect those policies. Changing to an unrestricted link is not a general solution to a recipient’s access problem.

Test the account you expect the recipient to use

Keep your owner session open. Use a separate browser profile or another account you control to check a disposable file. Test the intended recipient role first, then an account that should not have access. There is no need to invite a real colleague or send a notification during this rehearsal.

A private browser window can help reveal whether a broadly accessible link opens without your owner session. It does not demonstrate that a named recipient can sign in with the correct account. Test that question separately with an authorized account you control, and avoid entering credentials into unfamiliar pages.

For the permitted account, open the document and try the action you intend to allow. For the other account, confirm that the content is not available. Seeing a link preview in the messaging application is not the same check as opening the protected document under the recipient’s account.

Review what stopping sharing actually changes

OneDrive provides access-management controls for examining and changing permissions. Its documentation distinguishes sharing links from people who already have access.²⁵ When access should end, inspect those entries together rather than only deleting the URL from an old message.

Google also documents removing access and limiting downloading, copying, or printing.⁴ Those controls have a defined scope. A recipient who already retained information may still hold it elsewhere; changing the service’s access setting does not retrieve every copy. Google warns that its controls cannot stop people sharing the content in other ways.⁴

Treat revocation as a check on future access to the hosted item. In your test document, remove the trial grant, reopen the old URL from the other profile, and observe what happens. Keep your owner access intact throughout. If the other account still opens the item, inspect other grants and the parent folder before assuming the change failed to save.

Leave a short record for the next review

For an important share, record its purpose, intended audience, and the point when you plan to review it. Keep this note in a place appropriate to the document’s sensitivity. Avoid putting an access-granting URL in a public task list merely to make the review convenient.

When the work finishes, open the service’s sharing panel again. Check the people, groups, and links that remain. If someone reports an error, establish which account they are using before widening the audience. That keeps a routine login problem from turning into an unnecessary permission change.

A useful final check is simple: open the file using the intended account, confirm the allowed action, then verify that an account outside the audience cannot read it. Run this rehearsal on expendable content first, while you still have the owner session available.

References

Footnotes

1. Google Drive — Sharing audience and viewer, commenter, and editor roles: https://support.google.com/drive/answer/2494822?hl=en ↩ ↩² ↩³

2. Microsoft Support — OneDrive link audiences and existing access: https://support.microsoft.com/en-us/onedrive/share-files-and-folders-in-microsoft-onedrive ↩ ↩² ↩³ ↩⁴

3. Google Drive — Folder inheritance and sharing controls: https://support.google.com/drive/answer/7166529?hl=en ↩ ↩² ↩³ ↩⁴

4. Google Drive — Removing access and limiting downloading or copying: https://support.google.com/drive/answer/2494893?hl=en ↩ ↩² ↩³ ↩⁴

5. Microsoft Support — Reviewing and changing existing sharing access: https://support.microsoft.com/en-us/sharepoint/sharepoint-sharing-and-permissions/see-who-a-file-is-shared-with-in-onedrive-or-sharepoint ↩ ↩²