Sharing files seems simple, but the chosen method partly determines:

• who gets access;
• how long that access lasts;
• whether you can revoke access later;
• whether different versions of the same document arise;
• whether you keep track of where the file ends up.

The three most used methods

Why SharePoint or OneDrive usually gets preference

When you share a file via SharePoint or OneDrive, the original document remains in your Microsoft 365 environment.

You do not necessarily send a new copy but give someone access to the existing file.

This has several advantages:

• you maintain one central version of the document;
• access can be revoked later;
• you can determine whether someone may view or edit;
• you can restrict access to specific persons;
• you do not have to email a new version after every change;
• the access remains part of your Microsoft 365 environment.

Choose specific persons for sensitive files

SharePoint and OneDrive can offer different types of sharing links.

For sensitive or business-related information, a link for specific persons is usually preferred.

In this case, the recipient must prove that he or she is the intended person.

What is wrong with an email attachment?

An email attachment is not automatically unsafe.

For a small, non-sensitive file, an attachment can be perfectly practical.

The disadvantage is mainly that you have much less control after sending.

The recipient can, for example,:

• save the attachment locally;
• forward it;
• copy it;
• upload it to another service;
• keep it after you actually no longer want to share the document.

The version problem of email attachments

Suppose you send an Excel file to three colleagues or customers.

They each make changes and send the file back.

Suddenly, there are different versions:

With SharePoint or OneDrive, everyone, when allowed, can collaborate in the same document.

And what about WeTransfer or similar services?

External transfer services can be useful for sending very large files.

But for business information, you must first check whether using such an external service is permitted within your organisation’s policy.

After all, you bring the file outside your organisation’s Microsoft 365 environment and under the conditions and security measures of another provider.

This means you must consider, among other things:

• where the files are stored;
• how long they are retained;
• how the download link is protected;
• who can gain access;
• what logging is available;
• which contractual and privacy conditions apply.

But SharePoint links can also be forwarded, right?

That depends on the type of link.

An anonymous link intended for "anyone with the link" can indeed be easily forwarded.

That is why we prefer access for specific persons for confidential files.

Is the recipient allowed to download the file?

That depends on the purpose.

Sometimes the recipient must be able to save a file locally. In other situations, you want someone to only view the content.

Microsoft 365 offers possibilities in certain situations to restrict downloading.

Here too, technology can reduce risk but cannot guarantee absolute control over a human recipient.

Always check the recipient

The safest sharing technology does not help when you share a confidential file with the wrong person.

Therefore, check before sending:

• the name of the recipient;
• the full email address;
• whether the recipient really needs access;
• whether you have selected the correct file;
• which rights you grant: view or edit.

How do we share sensitive information?

The more sensitive the information, the more control is needed.

Think, for example, of:

• personal data;
• contracts;
• financial information;
• salary information;
• medical information;
• strategic business information;
• passwords and other credentials.

For such information, it is wise to consciously determine:

• who gets access;
• how the recipient’s identity is verified;
• whether downloading is allowed;
• how long access is needed;
• whether access must be revoked afterwards;
• whether the document may be shared at all via this method.

Do not share passwords via ordinary email

Passwords and other sensitive credentials deserve a separate approach.

Preferably use a professional password manager that allows data to be securely shared with the right people.

Which method to choose?

Technology must be correctly configured

SharePoint and OneDrive can be set up very securely, but the right settings are essential.

An organisation must, for example, determine:

• whether external sharing is allowed;
• which users may share externally;
• which types of links are available;
• whether anonymous links are allowed;
• how guests are managed;
• which information must be additionally protected;
• how old external access is monitored.

Accidentally shared something wrong?

Have you possibly shared a sensitive document with the wrong person or do you doubt whether an existing link is still safe?

Summary