Every shared link created in SharePoint Online remains active until it expires or someone revokes it. Over months and years, most tenants accumulate hundreds or thousands of active links pointing to content that no longer needs to be shared externally. Removing that backlog at scale is a routine hygiene task, but SharePoint Online provides no native tool to do it across more than one item at a time.
Why Sharing Links Accumulate at Scale
The SharePoint sharing model is designed to make link sharing frictionless. A user right-clicks a file, selects "Share," picks a link type, and sends it in seconds. That ease is the feature, and it is also the source of the problem over time. In a tenant where a hundred employees each create a handful of sharing links per month, the tenant accumulates thousands of active links per year. Most of them are created with good intent and forgotten immediately after use.
Links tied to former employees are the sharpest example. When an account is disabled in Entra ID, SharePoint does not automatically revoke the sharing links that account created. Those links remain active and accessible to anyone who has the URL. A Specific people link sent to an external contractor survives the contractor relationship ending. An Anyone link emailed to a client before a project wrapped up continues to work after the client engagement closes. Without active management, the list of live links bears no relationship to the list of active business relationships.
Sharing Link Types and Their Risk Profile
| Link type | Who can access | Risk level | Expires by default |
|---|---|---|---|
| Anyone | Any person with the URL, no authentication required | High | Only if a tenant expiry is configured; not set by default in many tenants |
| People in your organisation | Any authenticated internal user who has the URL | Medium | No; persists until revoked |
| Specific people | Only the named individuals (internal or external) | Lower | No; persists until revoked |
For admin-centre defaults and a full breakdown of how each link type interacts with your tenant sharing policy, see the SharePoint sharing link types reference.
When Should You Remove Sharing Links in SharePoint Online?
Bulk link removal is the right action in several clear situations:
- An employee leaves the organisation and held libraries or files that were shared externally
- A project or client engagement ends and the associated content should no longer be reachable from outside the organisation
- A compliance audit or security review surfaces active Anyone links on sensitive content
- Your organisation is preparing to enable Microsoft 365 Copilot and wants to tighten the data-access perimeter before AI features reach the content
- A routine quarterly review shows the link count has grown beyond what your governance policy allows
- A site is being decommissioned or archived and all external access should be revoked before the content is locked
Even outside these specific triggers, a structured link cleanup two to four times a year reduces the residual exposure that builds between targeted removal events. For the complementary audit step, the SharePoint shared links audit guide covers how to build a repeatable process around monitoring sharing activity before each cleanup run.
Step 1: Audit Active Sharing Links
Effective bulk removal starts with a complete, exportable inventory. Before removing anything, capture: the item being shared (file or folder), the site collection and library, the link type, who created it, when it was created, and whether an expiry is already set. This export serves as both a baseline record and an audit trail showing the state of sharing before the cleanup took effect.
Pay particular attention to links on content in these categories: libraries tagged with sensitivity labels, content owned by accounts that are now disabled, and folders shared across organisational boundaries to external domains you no longer have an active relationship with. These categories produce the highest-priority removal candidates.
Step 2: Prioritise Which Links to Remove
After clearing Anyone links, continue by context rather than link type alone:
- Inactive sites: Links on sites with no recent activity are candidates for removal regardless of type. Inactive content is less likely to be actively managed, and its sharing settings may reflect a previous state of the organisation that is no longer valid.
- Former employee ownership: Content in libraries originally created or primarily managed by a departed user should be reviewed. Links from their account remain live after account deactivation unless explicitly revoked.
- External domain specificity: Specific people links shared with a single external email domain from a former vendor or client relationship can be scoped and removed as a batch rather than one at a time.
Step 3: Bulk-Remove Links with ShareMaster Shared Links and Permissions
ShareMaster's Shared Links and Permissions tool connects to your Microsoft 365 tenant and displays all active sharing links across the sites in scope. Filter the list by link type, by site, by creation date range, or by creator, select the links you want to revoke, and execute the removal as a single batch operation.
Removing a link does not delete files. The file or folder stays in its library with the same direct permissions it had before. Only the link-based access path is closed. Recipients who click a removed link see an access-denied message; recipients who have been explicitly granted direct permissions to the item are unaffected.
For large tenants, scope the first pass to the highest-risk areas: site collections with the most active Anyone links, libraries containing labelled or sensitive content, and sites owned by accounts that have been disabled. Complete cleanup in batches to keep the change log manageable and simplify rollback review if any unexpected access complaints arise.
Learn more about Shared Links and Permissions in ShareMaster
Step 4: Configure Expiry Policies to Prevent Recurrence
Bulk removal addresses the existing backlog, but expiry policies are what keep it from rebuilding. Configure both of the following in the SharePoint admin centre under Policies > Sharing:
- Anyone link expiry (days): Set the number of days after which Anyone links expire automatically. A 30-day default is appropriate for most organisations; reduce this to 7 or 14 days for libraries holding confidential content. Any links created after this setting is applied will expire on schedule without additional admin action.
- Guest link expiry: Controls how long Specific people links to external accounts remain valid before requiring reauthorisation. Setting this to 90 days or fewer ensures that links to contractors and clients do not persist indefinitely after a relationship ends.
These settings apply prospectively. Links created before the policy took effect are not retroactively expired. That is exactly why the cleanup pass comes first: the policy alone does not close the existing backlog; it only governs what happens to new links going forward.
Organisations that need to restrict link creation altogether rather than just add expiry can lower the tenant-level external sharing setting. Moving from "Anyone" to "New and existing guests" removes the Anyone link option from the sharing dialog for all users. This is a significant operational change for organisations that rely on anonymous document distribution, so run it past your business process owners before making the change.
Frequently Asked Questions
Does removing a sharing link delete the file?
No. Removing a sharing link closes the access pathway provided by that link. The file remains in its document library, unchanged. Users with direct permissions to the item continue to have access as before; only users who relied solely on that link lose access.
Can I remove sharing links for content I do not own?
Tenant administrators and SharePoint administrators can remove sharing links across all site collections. Site owners can remove links within their own sites. Members and visitors do not have permission to remove links created by other users. When ShareMaster connects using an admin account, it can operate across the full tenant scope.
What happens to someone using a link when it is removed?
Access through the removed link fails immediately. Any attempt to use the link after removal returns an access-denied error. There is no grace period and no automatic notification sent to recipients. If you need to inform users that access is changing, do so before running the removal.
How do I prevent users from creating new Anyone links after a cleanup run?
In the SharePoint admin centre under Policies > Sharing, lower the external sharing scope to "New and existing guests" or below. This removes the Anyone link option from the sharing dialog entirely. Alternatively, keep Anyone links permitted but require an expiry date, which prevents them from being created without a defined end date and stops the no-expiry backlog from rebuilding.