What you are actually auditing
When a OneDrive file has been sent to a group, two different access routes can exist side by side. The first is a sharing link: a URL that grants whatever permission the link carries to anyone who uses it. The second is direct access: a permission granted to a named person or group. Disabling one does not automatically remove the other, and an old link can keep working until someone with authority over the file changes it.
This guide is for the file owner or an editor who needs a record of every route into a file, not a general account-security checklist. The goal is a short, owner-side audit: list the routes, disable what should no longer work, and recheck the exact old link rather than assuming it is dead.
Step 1: Confirm you have authority over the file
Only the file owner or someone with edit permissions can change sharing. If you received the file from someone else, you may be able to view it without being able to revoke anything. Before you start, confirm that you are working from the owner’s account or an account with edit rights on the item itself.
A file owner or someone with edit permissions can stop or change sharing permissions in OneDrive.
A file owner or someone with edit permissions can stop or change sharing permissions in OneDrive. Source
Step 2: Separate the link from the people
Open the item’s information panel and look for the access controls. In OneDrive, selecting a file or folder, opening Information and then Manage access exposes link and permission controls.
Selecting a file or folder, opening Information and then Manage access exposes link and permission controls.
Selecting a file or folder, opening Information and then Manage access exposes link and permission controls. Source
Treat the two lists as separate evidence:
- Links: each sharing link has its own permission level and its own state (active or disabled). A link sent to a group is still one link, even if many people received it.
- Direct access: named people or groups may hold Can Edit or Can View permission independently of any link.
A person can appear in the direct-access list and also have received the link. Removing one route does not prove the other is gone.
Step 3: Build an owner-side record before changing anything
Write down each access route while it still exists. This record is what lets you recheck the exact old link later. Use a simple table like this:
| Route | What to record | Why it matters |
|---|---|---|
| Sharing link | The exact URL as sent, its permission level, and whether it is active | You will recheck this same URL after changes |
| Direct access — person | Name or address, permission level (Can Edit / Can View) | Direct access can survive link changes |
| Direct access — group | Group name and permission level | Group membership may change outside your view |
| Where the link was posted | The channel or message where the URL was shared | Tells you who may still hold a copy |
Do not rely on memory for the URL. Copy the exact old link from the message or document where it was originally sent, and keep that copy for the recheck in Step 6.
Step 4: Disable the old link
In Manage access, locate the link you want to retire. Manage access offers disabling a link or changing Can Edit/Can View permissions, including Stop Sharing.
Manage access offers disabling a link or changing Can Edit/Can View permissions, including Stop Sharing.
Manage access offers disabling a link or changing Can Edit/Can View permissions, including Stop Sharing. Source
Two decisions are easy to blur here:
| Situation | Reasonable action | What it does not do |
|---|---|---|
| The link was sent too widely and should stop working | Disable the link or use Stop Sharing | It does not remove direct permissions held by named people |
| The link should stay, but with less power | Change Can Edit to Can View | It does not retract copies already downloaded |
| A named person should lose access | Remove or adjust that person’s direct permission | It does not disable a link they may also hold |
If the file was shared with a group, remember that a group is a single permission entry in the list but may represent many people. The interface shows the group, not necessarily each member.
Step 5: Review direct access separately
After handling the link, go back through the permission list for named people and groups. For each entry, decide whether that person or group should still have Can Edit or Can View. This is a separate decision from the link, and it needs its own record.
A practical checklist for the owner-side review:
- I confirmed I am the owner or have edit rights on the item.
- I recorded the exact old link and its permission level.
- I recorded every named person and group with direct access.
- I disabled the link or changed its permission level.
- I adjusted or removed direct permissions that should no longer apply.
- I rechecked the exact old link after the changes.
- I noted where the link was originally posted, so I can tell recipients it is retired.
Step 6: Recheck the exact old link
After you disable a link, test the exact URL you recorded, not a newly generated one. Open it in a context that is not already signed in as you, if you can do so without changing anyone’s permissions. The question is narrow: does this specific old URL still open the file?
If it still opens, the link may not be the route that is active, or a direct permission may be letting you in. Recheck the permission list before concluding anything. If you cannot test without signing in as another person, ask a trusted colleague who received the link to try it and report back.
Signing out of your own account is not a test of the link. Signing out changes your session, not the sharing configuration on the file.
Common mistakes
Treating sign-out as revocation. Signing out of OneDrive does not disable a sharing link. The link’s state is a property of the file, not of your session.
Assuming revocation erases copies. Disabling a link stops that route from granting access going forward. It does not reach into a recipient’s device and delete a file they already downloaded or saved.
Confusing a link with a person. Removing a named person’s permission does not disable a link they may also hold, and disabling a link does not remove direct access granted to a person or group.
Assuming a shared file is indexed. A file being shared does not, by itself, mean it is indexed by a search engine. Sharing and indexing are different questions, and this guide makes no claim either way.
Testing a new link instead of the old one. A freshly generated link tells you nothing about whether the old URL still works. Recheck the exact URL you recorded.
Editing the profile instead of the permission list. An edited or empty profile is not evidence that stored data was deleted. For access changes, work from the permission controls on the item itself.
Limits of this audit
This process covers what the owner-side controls expose. It does not guarantee that every copy of a file is gone, and it does not prove who actually opened a link. A permission list shows who was granted access, not who used it. If a link was posted in a public channel, you cannot know how many people copied the URL before you disabled it.
A username search is also not a complete account inventory. Public matches are leads, not proof of ownership, and matching handles or photos cannot independently prove identity. If you want to check your own known public handles as part of a broader footprint review, TraceSeek is an optional app that checks a username across 3,000+ platforms; a first scan is free and the stated scan time is 20-30 seconds. It does not change OneDrive sharing settings, access private content, or prove who owns an account.
For related owner-side reviews, see the guide on reviewing who can open your shared Google Drive files and the guide on finding forgotten online accounts.
Protecting your own footprint
A sharing audit is most useful when it becomes routine. Keep a short record of what you share, with whom, and by which route. When a project ends, retire the link and review direct access at the same time, rather than waiting for someone to ask.
Prefer named direct access over broad links when only a few people need the file. When you must use a link, record its exact URL and permission level so a later recheck is possible. And keep at least one recovery method you control until any cleanup is complete; do not delete recovery options before you have finished closing or changing access.
Key facts
- A file owner or someone with edit permissions can stop or change sharing permissions in OneDrive.
- Selecting a file or folder, opening Information and then Manage access exposes link and permission controls.
- Manage access offers disabling a link or changing Can Edit/Can View permissions, including Stop Sharing.
- TraceSeek checks a username across 3,000+ platforms, with a free first scan and a stated scan time of 20-30 seconds.
- A public username match is a lead, not proof of account ownership.