Microsoft 365 makes it easy to share a file or invite someone into a Team. That ease is the point—and the risk. For San Antonio and Hill Country businesses working with accountants, GCs, vendors, and seasonal partners, guest sharing is normal. Uncontrolled guest sharing is how “temporary” access becomes permanent, and how the wrong folder ends up one forward away from the wrong inbox.
This is not about locking the doors so tight nobody can collaborate. It is about defaults, link types, and a guest lifecycle you can explain to a busy office manager.
External sharing defaults set the tone
SharePoint and OneDrive have organization-level settings for who can share with people outside your company, and site-level settings that can be tighter. Teams inherits a lot of this through the underlying SharePoint site for each Team.
If the default is “anyone with the link,” convenience wins every time. If the default is “people in your organization” or “specific people,” staff can still share externally—they just take one more intentional step. That friction is a feature.
Owners should know, in plain words:
- Can staff create links that work for anyone on the internet?
- Can they invite guests into Teams, or only share individual files?
- Do new SharePoint sites inherit the company default or something looser?
AEH’s managed Microsoft 365 work usually starts by documenting those answers before changing anything. You cannot govern what you have not named.
Link types: anyone, organization, or specific people
When someone clicks Share, the link type decides how wide the door opens.
- Anyone links — open to whoever gets the URL, sometimes with an expiration or password. Easy for a quick PDF to a vendor. Easy to forward forever.
- Organization links — only signed-in people in your tenant. Fine for internal back-and-forth; useless for true outsiders.
- Specific people links — named recipients must authenticate. Better audit trail; slightly more setup.
For sensitive folders—HR, banking, open job pricing—prefer specific people and short expirations. For a public brochure, an anyone link with an end date may be fine. Match the link to the content, not to whatever the dialog offered first last Tuesday.
Guest lifecycle: invite, use, review, remove
Guests accumulate. A project Team from 2023 still has the architect’s personal Gmail. A SharePoint folder still lists a bookkeeper you no longer use. Nobody meant harm. Access just never got a closing date.
A simple lifecycle keeps the office from leaking by neglect:
- Invite with a purpose — which Team or folder, and for how long?
- Use least access — member of one Team, not guest in the whole company directory of sites
- Review on a schedule — quarterly is enough for many SMBs; monthly if you have lots of outside partners
- Remove when the job ends — same day you close the project file, if you can
Write the review owner’s name on a calendar. “We should clean guests sometime” is not a control.
SharePoint (and Teams) vs email attachments
Email attachments create copies. Every forward is another copy you do not control. Version five lives in someone’s Downloads folder while your Team still edits version three.
Sharing a SharePoint or Teams link keeps one living file (permissions willing). Guests see what you allowed. You can revoke access without asking them to delete attachments they may not remember.
That does not mean email is banned. It means large or sensitive files, and anything that will change for weeks, belong in a shared library with intentional links—not as a 20 MB reply-all.
Habits that keep managed M365 healthy
Technology settings help. Habits finish the job:
- Name Teams and libraries so people know what belongs where (“Vendor – Roofing Bid,” not “Stuff”)
- Avoid putting the whole company file share into one Team with open guest access
- Train people to ask “does this person need the folder or one file?”
- Turn off unused sharing links when a project ships
Under managed Microsoft 365, AEH can help set sensible defaults, walk through guest reviews, and tie sharing policy to how your office actually works—construction packets, CPA folders, ranch ops docs, and the rest—without pretending a Secure Score screenshot is the whole story. We will not invent score improvements or awards. Cleaner sharing is the goal.
Next step
If guest access and external links have grown by accident, a Microsoft 365 hygiene pass is a good start. AEH Solutions also offers a free IT assessment for businesses in San Antonio and the Texas Hill Country—useful when you want sharing, identity, and backup looked at together.
Request your free IT assessment or contact us when you are ready. We will keep recommendations practical and sized for a real small-business tenant, not an enterprise binder.