ojava
Start free trial

All guides

Many files shared outside the company

What happened

One person shared many files with outside addresses or made them public within an hour. It can be a project, or someone taking your data.

How serious

Serious: deal with it today.

Steps: Microsoft 365

  1. Call the person (don't email: their mailbox may be in someone else's hands) and ask whether it was them.

  2. Stop the sharing: open the person's OneDrive (or the SharePoint site) → Shared → each file → Manage access → stop the outside links and guests.

    Open the page: www.office.com/launch/onedrive
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

  3. Limit sharing for everyone: SharePoint admin center → Policies → Sharing → set OneDrive and SharePoint to 'New and existing guests' or stricter (no 'Anyone' links).

    Open the page: admin.microsoft.com/sharepoint?page=sharing&modern=true
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

  4. Sign them out everywhere: Microsoft Entra admin center → Users → the person → Revoke sessions. This also logs out an attacker who copied their session.

    Open the page: entra.microsoft.com
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

Steps: Google Workspace

  1. Call the person (don't email: their mailbox may be in someone else's hands) and ask whether it was them.

  2. Stop the sharing: in their Google Drive → each file → Share → set General access to Restricted and remove outside people.

    Open the page: drive.google.com
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

  3. Limit sharing for everyone: Google Admin console → Apps → Google Workspace → Drive and Docs → Sharing settings → allow sharing outside only with allowlisted domains, or warn.

    Open the page: admin.google.com/ac/appslist/core
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

  4. Sign them out everywhere: user page → Security → Sign-in cookies → Reset. This also ends a session an attacker copied.

    Open the page: admin.google.com/ac/users
    Type the address yourself or use your bookmark: never follow a link in an unexpected email.

How to check it’s fixed

Fixed when the shares are stopped or confirmed as wanted, and the sharing settings match how you work. You can change the alert threshold in Settings → Team.

When to call your IT provider

Call your IT provider now if the person didn't do this, or if you are unsure.