Email and Microsoft 365 · Knowledge Base

How To Share A File Safely Instead Of Attaching It

Attachments are a copy you can never take back. A link is not.

In short: to share a file safely, send a link rather than an attachment, share with named people rather than anyone with the link, and set an expiry. A link can be revoked, which is the whole reason to share a file safely this way.

Every attachment you send is a permanent copy sitting in somebody else’s mailbox, outside your control, forever. That is fine for a menu and a problem for a contract.

Sharing a link instead keeps one copy, under your control, with a record of who opened it.

Why The Link Wins

You can revoke it. If you send the wrong thing, or somebody leaves, access ends the moment you say so. An attachment cannot be recalled in any meaningful sense.

Everybody sees the current version. No more four people working on three versions of the same spreadsheet and reconciling it afterwards.

You get a record of who opened it and when, which matters more than people expect the first time a client says they never received something.

The Four Settings That Matter

Who can open it. Default to specific people. “Anyone with the link” means anyone the link is forwarded to, which is usually more people than you pictured.

View or edit. Most sharing should be view-only. Edit is for people who are genuinely working on it with you.

An expiry date. Set one for anything client-facing. Links live forever otherwise, long after the project ends.

Block download for anything genuinely sensitive. It is not perfect, but it means a copy does not silently walk out.

When You Share The Wrong Thing

Stop the sharing first, before anything else. Removing access takes seconds and shrinks the problem.

Then check the access log to see whether anybody opened it. That answer decides whether this is an accident or an incident.

If it was opened by somebody outside the business and it contained anything sensitive, call 678-374-4352 and treat it as an incident.

A Two-Minute Audit Of What You Already Shared

Open OneDrive in your browser, choose the Shared view, and look at the files you have shared with others. Most people find links to old proposals, a former colleague, or a client the business no longer works with.

Every one of those stays open until somebody closes it. Learning to share a file well starts with tidying the shares you made before you knew the rules, and that list is the quickest place to begin.

Mistakes That Undo Careful File Sharing

Using a personal account because the work one feels slow. When you share a file from a personal Dropbox or a free transfer site, the business has no record of it and cannot switch it off.

Sharing team documents from your own OneDrive. Files that belong to a department should live in that team’s SharePoint or Teams site, because links from a personal OneDrive can stop working when that person moves on.

Sending the password in the same email as the link. If a document is protected with a password, give the password by phone or text message, so one intercepted email is not enough to open it.

Changing the recipient because an email told you to. A message asking you to share a file with a client’s new address is a classic fraud pattern, so confirm it on a number you already have.

Sharing Situations To Bring To Us Before You Click

Talk to us first if a client wants anyone with the link because their firm blocks sign-ins, or if you need to share a file with a whole outside organization every week. Both are better set up once than improvised each time.

An unexpected share notification asking you to sign in, or a link to your files appearing somewhere public, needs a prompt report to security on 678-374-4352, option 1, which runs 24/7.

After-hours questions about link settings or permissions belong in a ticket, which the help desk works through from 8 AM Eastern, Monday to Friday.

The Problem With Attachments

Emailing a document feels like the safe, simple option and it is neither. The moment you attach a file and press send, you have created a copy you no longer control, sitting in a mailbox you cannot see, forever.

If you sent it to the wrong person, there is nothing to undo. If the document changes, there are now two versions and the client is working from the old one. If the recipient forwards it, you will never know.

A shared link inverts all of that. There is one file. You can revoke access after the fact. You can see who opened it. And when you update the document, everyone is looking at the current version rather than an artifact of last Tuesday.

For a law firm sending anything that touches a matter, that difference is not a convenience. It is the difference between a recoverable mistake and a disclosable one.

Anyone With The Link Is The Setting That Causes Incidents

Every file sharing platform offers a quick share option, usually worded as anyone with the link. It is the default in many setups and it is the single most common cause of accidental exposure.

A link that works for anyone works for anyone it is forwarded to, anyone who finds it in a forwarded email chain two years later, and in some circumstances anyone who guesses it.

Sharing with specific people instead means the recipient has to prove who they are. It is one extra step for them and it removes the entire category of problem.

The honest exception is a genuinely public document, a brochure or a form. Everything else, and certainly anything with a client name on it, should be shared to named people.

If you are not sure which setting your shares default to, ask us and we will check. It is a tenant level setting and it is worth getting right once rather than remembering every time.

Expiry Dates And The Folder You Did Not Mean To Share

Two habits prevent most of the rest.

Set an expiry on external shares. Thirty days covers almost every legitimate need, and it means access ends by itself rather than persisting because nobody remembered to remove it. A share with no expiry is a permission you will still have in five years.

And check what you are actually sharing. The most common serious mistake is sharing a folder rather than a file, where the folder also contains three other clients. The recipient sees everything in it, and the fact that you only meant to send one document is not a defense.

Before you share a folder, open it and look at what is in it as though you were the recipient. If the answer is anything you would not put in the same envelope, share the individual file instead.

What To Do When It Goes Wrong

Sooner or later somebody sends the wrong link to the wrong person. What happens next is what matters, and there is a right order.

Revoke the link immediately. Every platform allows this and it is usually two clicks. If the recipient has not opened it yet, that is the end of the incident.

Then tell us, on 678-374-4352. We can check the access log and tell you whether it was opened, by whom, and when. That answer is what determines whether this is a near miss or something that needs disclosing.

Do not delete the file. Deleting it destroys the audit trail that proves what happened, which is exactly what you need if a client or a regulator asks.

And do not email the recipient asking them to delete it before you have revoked access, because a surprising number of people open the link to see what they are being asked to delete.

A Checklist To Share A File Safely Every Time

Ten seconds before you send anything outside the business.

Send a link rather than an attachment.
Share with specific named people, not anyone with the link.
Set an expiry date on any external share.
Choose view only unless the recipient genuinely needs to edit.
Open the folder and look at what else is in it before sharing it.
Check the recipient address character by character.
For anything with a client name, share a file safely by link only.
If you shared the wrong thing, revoke the link immediately.
Do not delete the file afterwards. It holds the audit trail.
Tell us, so we can check whether it was opened.

Line five prevents the most serious version of this, which is sharing a folder containing three other clients.

Sharing Files In Your Industry

What counts as sensitive is different in each of the three sectors we specialize in.

Law firms. Everything touching a matter is confidential by default. To share a file safely at a firm means named recipients, an expiry, and an audit trail you can produce if asked. Attachments give you none of the three.

Distribution and logistics. Pricing and customer lists are the crown jewels. A shared folder with an open link is how a price list ends up with a competitor, usually via a forwarded email nobody remembers.

Manufacturing. Drawings and specifications carry intellectual property, and they get sent to contractors and suppliers constantly. Expiry dates matter most here, because a link shared for one job should not still work three years later.

If you want the safe settings to be the default rather than the careful choice, we can set that at the tenant level. Call 678-374-4352.

Making The Safe Way The Easy Way

People do not share a file safely by default because the safe path is slower than the unsafe one. If attaching is two clicks and sharing a link properly is six, attaching wins on a busy afternoon regardless of what any policy says.

So the useful work is changing the defaults rather than changing behavior. If new shares default to specific people rather than anyone with the link, and if an expiry is applied automatically, then the safe path becomes the default path and nobody has to remember anything.

That is a tenant level setting, not something each person configures. It takes minutes and it is the single highest value change available in this whole topic.

The second change is habit. Teaching people to reach for Share rather than Attach takes a week of gentle correction and then holds permanently, because once you have revoked a link you understand exactly why it matters.

The third is making it visible. If a folder contains multiple clients, the person sharing it needs to see that before they share, not afterwards.

Ask us to review your sharing defaults. If nobody has looked at them since the tenant was set up, they are almost certainly wider than you would choose today.

Questions To Ask Before Any External Share

Four questions, ten seconds, and they prevent the versions of this that actually cause damage.

Who exactly needs this? If the honest answer is one named person, share a file safely to that person rather than to a link that works for anybody.

What else can they see? If you are sharing a folder, open it and look at it as though you were the recipient. This is where the serious mistakes happen.

Do they need to edit, or only to read? View only should be the default, and edit should be a deliberate decision.

When should this stop working? Thirty days covers almost every legitimate purpose. A share with no expiry is a permission you will still be granting in five years without knowing it.

If you can answer all four quickly, you can share a file safely without slowing down. If you cannot answer the second one, stop and check.

What Happens After You Share A File, And Who Can See It

One thing worth understanding is what a share actually creates, because it explains why the settings matter so much.

When you share a file by link, you are not sending anything. You are creating a permission and handing somebody an address. The document stays where it is. That is why you can revoke it, why the recipient always sees the current version, and why you can tell afterwards whether it was opened.

When you share a file as an attachment, you are creating a copy. It leaves your control the moment you press send, it will not update when you edit the original, and there is no record of where it went afterwards. If it turns out you should not have sent it, there is nothing to undo.

That difference is the entire reason this guide exists. Everything else is detail.

The audit trail matters more than most people realize. If a client or a regulator asks whether a document was accessed, a link share can answer that question with a timestamp. An attachment can only be answered with a shrug.

It also changes what a mistake costs. Sharing the wrong link to the wrong person, caught within an hour, is usually a near miss because the link can be killed before anyone opens it. Sending the wrong attachment is a disclosure from the moment it lands.

So when you share a file, think of it as granting access rather than sending a document. Access can be narrowed, dated, watched and withdrawn. A document that has been sent cannot be any of those things.

If you want us to set your sharing defaults so the safe option is the automatic one, call 678-374-4352.

Questions About Sharing A File Safely

Is an attachment ever fine?

Yes, for anything you would be happy to see forwarded anywhere.

Can I stop someone downloading?

For some file types, yes. It is a setting on the share.

Can I see who opened it?

Yes, that is one of the main reasons to use a link.

I shared the wrong file. What now?

Remove access first, then check the log, then call us if it was opened externally.