Shared business files should be accessible to people who need them for a current task, with permission to do only what that task requires. An employee updating a project budget needs different access from a supplier checking a delivery schedule.
For Australian businesses, managing Microsoft 365 file permissions starts with three questions: who needs access, what should they be able to do, and when should that access end?
Keep those answers current as staff change roles, contractors finish work and shared folders grow.
Quick Overview
- Choose the audience for a sharing link separately from its view or edit permissions.
- Give editing access when someone needs to change the shared content.
- Check group and site membership alongside individual sharing links.
- Give external collaborators access to a clearly defined set of files.
- Assign an owner and review date to important shared locations.
Start with one frequently used folder and work through the checks below.
How Shared Links Differ From Direct Access
A sharing link is more than a convenient address. Depending on its settings, it can provide access to a particular audience.
Microsoft distinguishes several options:
- Anyone: People holding the link can use it, including external recipients. Authentication is not required.
- People in your organisation: The link works for people inside your Microsoft 365 organisation who receive it.
- Specific people: The link works for the named recipients, while others may already have access separately.
- People with existing access: The link points recipients to content they can already open; it grants no additional permission.
The options available depend on your administrator’s settings. Microsoft Support
Direct access gives a person or group permission to the item without relying on a particular sharing link. Access can also come from the surrounding site or folder. Microsoft Support
Check every relevant access route before deciding a file is restricted. Sending someone a view-only link does not remove editing rights they already hold.
For example, a staff member may receive a restricted link while remaining a member of the team that manages the document. The link alone does not describe their complete access.
Choosing Sensible Access Levels
Start with the work someone needs to perform.
A client checking a finished proposal may only need to view it. A colleague maintaining a live cost spreadsheet needs editing rights. Someone commenting on a Word draft may be suited to the review option, where available.
Microsoft’s sharing controls distinguish viewing, editing and, for Word documents, reviewing. View access can still allow downloading or copying; it should not be treated as a guarantee that information stays inside the browser. Editing a shared folder can permit actions including adding, moving, renaming and deleting content. Microsoft Support
That makes “Can edit” a meaningful decision. It is not simply the polite version of “please have a look”.
Match Access to Responsibilities
Use a simple working rule:
- Readers receive view access.
- Contributors receive the editing access their task requires.
- People responsible for managing the shared location receive the appropriate ownership role.
Reserve ownership for people who will actually maintain membership and settings. Nominate a backup so decisions do not stall during leave.
For SharePoint sites connected to Microsoft Teams, Microsoft recommends managing membership through Teams. Private and shared channel sites have their own membership arrangements, so check the relevant channel too. Microsoft Learn
Avoid adding someone to an entire team merely to solve a request for one document. First establish how much content the task requires.
Reviewing External Guest Sharing
External access is often necessary. Accountants, designers and subcontractors may all need business documents, but their access should have a defined purpose.
Before sharing, ask:
- Is this the correct person and email address?
- Do they need one file, a folder or ongoing project access?
- Does the location contain unrelated internal information?
- Who will confirm when their work finishes?
Consider a subcontractor who needs installation drawings. A dedicated project folder is easier to assess than a general operations folder containing drawings, internal pricing and staff records.
Microsoft applies external sharing controls at both organisation and site level, with the more restrictive setting taking precedence. It recommends keeping information that must never be shared externally in a site where external sharing is disabled. Microsoft Learn
Ask your administrator about suitable defaults, permitted external domains and guest expiration settings. Microsoft provides controls for these, but their configuration needs checking; inviting a guest does not establish that an appropriate expiry has been applied. Microsoft Learn
Treat an anonymous Anyone link separately from named guest access. Knowing which guests are listed does not, by itself, account for everyone who could hold an anonymous link.
Setting a Regular Permissions Review
A useful review needs an owner, a scope and a date.
As a practical starting point, consider monthly checks for locations containing sensitive information or changing external collaborators, and quarterly checks for stable internal working folders. Adjust that schedule to your business; these are suggested intervals, not Microsoft requirements.
Also review access when someone leaves, changes roles or completes a contract. A calendar reminder should support those events, not delay them.
Keep a short record of the shared location, responsible owner, approved audience, external collaborators and next review date.
When checking an item, use Manage access to inspect people and sharing links. Where permission comes from a parent folder or site, address that source of access. Deleting one sharing link does not remove a separate permission the person holds elsewhere. Microsoft Support
Ask the business owner to confirm who still needs access, then involve the administrator where the permission structure is unclear.
A Quick Guide: Sharing Files With an External Bookkeeper
Imagine a small Australian business engaging a bookkeeper to reconcile several months of transactions. Its finance folder also contains payroll documents and confidential planning notes.
Does the bookkeeper need everything in that folder? Will they update working documents or only read supporting records? Who will close access when the engagement ends?
1. Define the required documents
Agree on the records needed before sharing. Keep unrelated payroll and planning material outside the shared location.
2. Choose the audience and access level
Use named sharing for the intended recipient. Grant editing access only where updating the shared files is part of the job.
3. Check the surrounding permissions
Have the owner or administrator confirm that broader folder, site or group access does not undermine the intended boundary.
4. Set a review point
Record the engagement’s expected finish and assign someone to review access then.
This gives the bookkeeper a clear working area and gives the business an understandable boundary to maintain. It also makes future reviews easier because the reason for access is documented.
Quick Self-Check Before You Share
Use these questions as a discussion checklist:
- Can I explain why each recipient needs this information?
- Have I checked the link audience and the permission level?
- Do I know whether broader access already exists?
- Is someone responsible for reviewing access later?
An uncertain answer identifies something to check before sending.
Conclusion
The right people to access shared business files are those with a clear, current reason to use them. Give readers viewing access, contributors suitable editing rights and responsible owners the ability to maintain the shared location. Keep external collaboration focused on the documents required, and check the wider permissions that may already exist. Good Microsoft 365 file permissions depend on decisions people can explain and revisit. Start with one important folder, confirm its audience and nominate its owner. Then schedule a review and include access checks whenever staff responsibilities or external engagements change.
