Stop Unwanted People Using Sharing Links Sent for Documents
Announced at session BRK3100 at the Ignite 2018 conference last September and then included in the OneDrive for Business Roadmap update for June 2019, password-protected sharing links are now available across Office 365.
Only for Anyone Links
Before getting too excited, let’s reflect that this feature only work for Anyone sharing links. These are the links that can be used by anyone who has them. Many Office 365 tenants tune the sharing controls for SharePoint Online and OneDrive for Business to prohibit the use of Anyone links because they consider them a security risk. But if your tenant allows Anyone links, you can now protect them with custom passwords. The password protected sharing link feature is available in the SharePoint Online and OneDrive for Business web clients. Block download is available in the OneDrive mobile client.
Sending Password-Protected Links
To begin, select a document and share it. Select “Anyone with the link” as the share. Click Anyone with the link to change the settings. In Figure 1 you can see that a password has been entered and we’ve also selected the option to block the recipient from downloading the document. This forces Office 365 to call the online app to display the content, so it only works for Office documents.
When you’ve updated the settings, click Apply. You should now see that the icons under the link have changed to include a padlock (password protected) and download barrier (Figure 2).
If a sharing link has already been created with a password, you’ll have the chance to update the link with a new password or use the existing password (Figure 3). It’s not a good idea to replace a password on a sharing link unless you update previous recipients with the new password.
Click Send to tell Office 365 to create and send the message with the sharing information. You’ll find the message in the Sent Items folder of your Exchange Online mailbox. When the recipient opens the message, they’ll see that the link will work for anyone with the password. Before they can open the content, you’ll need to give them the password through email, a voice message, SMS, Teams personal chat, or other method. Once they have the password, they can click the link, input the password (Figure 4) and see the content.
Limited Access to Content
In our case, the link we sent was both password-protected and blocked for download. As noted above, if the document is an Office file, Office 365 calls the relevant online app to open it. As you can see in Figure 5, the user is blocked from downloading and printing the file.
If necessary, you can use SharePoint’s Modify Access feature to update sharing links, including the ability to reset passwords in links. You can’t remove a password from a link once it is present.
Password-protected sharing links are straightforward to use. The sole difficulty might be for organizations to embrace the idea that they can permit Anyone links. After all, even if you decide that it’s OK to allow these links, there’s no way to force users to add passwords to the links every time. Perhaps that might be a future feature.
For more information about managing SharePoint Online and OneDrive for Business, read the chapter in the Office 365 for IT Pros eBook.