The engagement is finished. Your consulting firm has delivered the final report and removed the sharing link from a project folder. Then a client contact says they can still open a working spreadsheet.
Before treating that as a software failure, check how access was granted. A link is one possible route to a file. It may not be the only one.
This checklist is for an authorized owner or administrator reviewing Microsoft 365 work files in OneDrive or SharePoint. Start with the engagement's agreed handoff and access requirements, rather than removing every external user at once.
Start with the exact file and account
Record the file or folder address, the client's email address and whether the item belongs to an employee's OneDrive or a SharePoint site. Ask whether the contact is opening the live online file or an earlier downloaded copy.
Keep this distinction in the project notes. Removing online access is not a way to recall copies already downloaded or delivered to the client.
Confirm what should remain available. For example, the client may need the final report but no longer need your internal working folder. Treat this as a hypothetical workflow, not a reason to remove access to agreed deliverables.
Inspect links and direct access separately
Select the item in the web interface and open Manage access, sometimes reached through the Details pane. Labels can vary by interface.
Microsoft's sharing-permissions guide distinguishes sharing links, direct access and access through the site. Use that distinction to build a short list of the routes you need to review.
Remove the obsolete link after checking who still needs it. Then inspect the person's direct access. If that remains, deleting a different link is not enough. Where access comes from a parent folder or site, have the authorized owner review that source instead of repeatedly changing the individual file.
Avoid using a broad “Stop sharing” action until you understand who else depends on the item.
Check the parent folder and project membership
A project folder can sit inside a site that the client already has permission to use. Ask the site owner to check membership and any associated Microsoft 365 group before changing permissions. Removing someone from a shared project group can affect more than one document.
Also inspect important working files individually. Microsoft explains that files and folders can have unique permissions, rather than simply matching their parent. Giving a person a new view-only share does not necessarily remove an existing edit permission.
For a small engagement, start with the final deliverable, its parent folder and any working file reported as accessible. Expand the review if you find inconsistent sharing, rather than assuming one successful check covers the whole site.
Test the result without exposing client work
After the owner makes the approved change, document the item, access route changed, date and expected outcome. Arrange an authorized check using the affected account, without requesting its password or signing in as the client yourself.
Confirm that the old route fails and that intended recipients can still open the approved deliverables. A private browser window can help distinguish a signed-out link check from a signed-in test, but it does not prove what every account can access.
If results differ from expectations, stop making unrelated changes. Give the administrator the exact address, account, test time and result.
Make access review part of project closeout
For the next engagement, assign a folder owner and an access-review date when the workspace is created. Keep client-facing deliverables separate from internal working material, and record who approves continued access.
Microsoft's explanation of sharing link types notes that Anyone links can be forwarded, while Specific people links require the specified recipient to authenticate. Choose the type appropriate to the workflow and your firm's policy. A more restricted new link still does not erase permissions already granted another way.
Get help tracing the access problem
If a client can still open a file after your firm removes a link, FMA can help work through the Microsoft 365 access problem with your authorized owner or administrator. Review the remote IT support scope, then Get IT Help with a short description of the symptom and how many people are affected. Keep passwords and confidential project files out of the initial inquiry.
FMA is based in Columbia, Maryland, with remote support nationwide. Scope and cost are discussed before paid work begins; a managed IT contract is not required.
