A link someone in your office shared three years ago is probably still working.
Every time a person hits Share on a document in Microsoft 365, they create a key. That key doesn't expire when the project wraps, when the prospect goes cold, or when the employee who made it moves on. It just sits there, quietly working.
For a wealth management firm, that's where it gets uncomfortable. A performance report sent to a prospect who never signed. A folder of account paperwork shared with an outside CPA on a deal that died two years ago. Nobody did anything wrong. The links just piled up.
Two things worth doing this quarter.
Check what your default share link actually is. Microsoft lets you set it at the organization level and site by site, and most firms have never touched it, so your team is clicking whatever shipped with the tenant.
Then look at who actually has access. If anyone in your tenant has a Microsoft 365 Copilot license, the SharePoint oversharing reports come with it: sharing links, permission state, site access reviews. You're already paying for them.
The conversation you don't want is a client asking who else can see their statements and not having an answer.
Worth a look before your next cyber insurance renewal.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email