That client share link never expired. And nobody can see who opened it.

A client asks for their year-end statements. Someone on the team right-clicks, hits Share, copies the link, pastes it into an email. Nine seconds, done.

Here's the part most firms never think about.

If your tenant allows "Anyone with the link," that link doesn't ask anybody to sign in. Microsoft's own documentation says it plainly: forwarded links work internally or externally, and you can't track who has access to shared items or who has accessed them.

So the client forwards it to their CPA. The CPA forwards it to an assistant. Months later that link is still live in four different inboxes, and you have no record of any of it.

Nobody did anything wrong. The tool just defaulted to convenient.

Two settings fix most of it. You can require those links to expire after a set number of days, so an old email stops being an open door. And you can use sensitivity labels to make "specific people" the default sharing link — so the safe choice is the one that happens automatically when someone is in a hurry.

Neither one slows your team down. They just change what happens when nobody is thinking about security.

Worth a look before your next cyber renewal. Or before a client asks who else has seen their statements.