Regulated teams share files with outsiders constantly: a contract research organisation sending study data to a sponsor, a finance firm sending statements to a client, a clinic sending records to a specialist. The usual tools handle the sending part fine. What they handle badly is proving, months later, exactly who opened what and when.
That proof is the actual requirement. Here is how to set external sharing up so it holds.
Why email attachments fail the test
An attachment leaves your control the moment it sends. You cannot revoke it, you cannot tell whether it was forwarded, you cannot expire it, and the recipient’s copy is now a second uncontrolled original. There is also no reliable record that the right person opened it rather than a shared inbox.
For routine documents that is acceptable. For anything with a regulatory or contractual obligation attached, it is not.
The controls that matter
- Named recipients, not open links. Access tied to a verified identity, so the audit trail names a person rather than “anyone with the link”.
- Expiry by default. Every external share carries an end date, set centrally so nobody has to remember.
- View only where appropriate. Download prevention is imperfect, but it changes the default from copy to consult.
- Revocation that works retroactively. You need to pull access back after the fact, and see that it took effect.
- Access logging you can export. Who opened it, when, from where, in a format you can hand to an auditor.
- Watermarking for sensitive documents. It will not stop a photograph of the screen, but it ends plausible deniability.
- Encryption in transit and at rest. Table stakes, and still worth confirming rather than assuming.
- Data location control. Some contracts specify where data may be stored. Know which region your tenant uses.
Three workable approaches
| Approach | Good for | Trade off |
|---|---|---|
| SharePoint or Google Drive with hardened external sharing | Ongoing collaboration with known partners | Defaults are too permissive, so configuration is the whole job |
| Per project guest access | A study, a deal, a defined engagement with an end date | Guest accounts accumulate unless offboarding is enforced |
| Dedicated secure transfer portal | One way delivery of sensitive files at volume | Another system to administer and pay for |
Most regulated small and mid sized teams are best served by the first two combined: a properly hardened tenant, plus per project guest access with an expiry. A separate portal is justified when delivery volume is high or a client contract names that requirement specifically.
The settings that are wrong by default
- Anyone links enabled. Turn off link sharing that does not require sign in, at least for libraries holding regulated data.
- No expiry on external shares. Set an organisation wide default, measured in weeks rather than never.
- Every user allowed to invite guests. Restrict it, or at minimum log and review it.
- Download permitted everywhere. Consider view only on the libraries where a copy leaving is the thing you are trying to prevent.
- Guest accounts never reviewed. Schedule a quarterly review and remove the guests whose project ended.
- Sharing activity not monitored. Alert on bulk external sharing. It is also one of the earliest signals of a compromised account.
Write down the answers before an auditor asks
Four questions you should be able to answer within a day, not a week. Who outside the organisation currently has access to our data? What can each of them do with it, specifically? When does that access end? Can we produce an access log for a named file covering the last twelve months?
If the fourth answer is uncertain, that is the place to start, because it is the one a client or regulator asks for first and the one that takes longest to retrofit.
Configuration, guest lifecycle and logging are covered under cloud file sharing and access setup, with tenant hardening under Microsoft 365 management and Google Workspace management. For a documented review of where your data currently goes, see cybersecurity health check.