See who can access a OneDrive or SharePoint file

A View link does not necessarily make a file view-only for everyone. Someone may also have Edit access through a site group, a parent folder, or another link. Manage access helps you identify those routes before asking anyone to change permissions.

Check the file’s access routes

In a OneDrive work or school, SharePoint, or Teams document library, select the file, open Share, then choose the shared-circles indicator and Manage access. You can also select the file and use Details, then Manage access. The panel separates People, Groups, and Links. Select a person’s name to see an Access summary, which can include site-group access. An external person may appear with an email address and an External User label. Microsoft’s guide to seeing who a file is shared with, Microsoft’s permissions guide

Read each route separately. A person can have direct access, access through a link, or access from the site. Permissions inherited from a parent folder or site need to be reviewed at that parent level. Manage access is an inspection step here; you do not need to change a company setting to find the route. Microsoft’s permissions guide

Why a View link may coexist with Edit access

Suppose the intended arrangement for Proposal.docx is View access for Maya and Lee, with Edit access for the internal owner. In a fictional example, Maya has direct View access but also belongs to a site group with Edit access. The View grant does not explain away the Edit route. Open Maya’s Access summary and identify both before deciding what needs review. A site permission can give someone access independently of a sharing link. Microsoft’s guide to seeing who a file is shared with, Microsoft’s SharePoint sharing guide

The same example appears in this synthetic access-routes worksheet. It is a teaching CSV, not a Microsoft export or the result of a tenant test. Its seven entries show what to ask about each route:

Worksheet entry	What to check
Maya: direct View	Look for any other route in her Access summary.
Maya: parent-site Project reviewers group, Edit	Ask the site owner whether that group should cover this file.
Lee: Specific people link, View	Check that Lee is among the named recipients.
“Former agency”: Anyone link, View	Treat the name as a worksheet label. It does not identify who holds the link.
Internal link holders: organization link, Edit	Review the link’s audience and Edit permission.
Finance members: parent-site Finance group, Edit	Ask the group owner to confirm its membership.
Sam: People with existing access link	Find Sam’s underlying grant; this link adds no permission.

These link types answer different questions. An Anyone link can be forwarded to people who are not individually named in the People list. An organization link is limited to people in the organization. A Specific people link is scoped to its named recipients even if forwarded. A People with existing access link does not create a new permission, so finding one for Sam does not tell you how Sam got access. The link’s Can edit or Can view setting describes that link’s permission, not every other route to the file. Microsoft’s SharePoint sharing guide

Record what remains unresolved

Keep three questions separate: Who has a permission route? Who actually opened the file? Who may already have a copy? Manage access addresses the first question. Its entries do not establish that someone opened a PDF, received a read receipt, or downloaded a copy. A View setting should not be treated as a guarantee that no outside copy exists.

For the fictional Proposal.docx example, a useful note to the site owner would be:

Intended access is View for Maya and Lee and Edit for the internal owner. The worksheet lists Maya’s Edit route through the parent-site Project reviewers group, plus an organization Edit link and an Anyone View link. Please confirm the Finance group roster and review whether the parent-site group should cover this file.

That request targets the unresolved routes. Deleting only a View link would leave Maya’s site-group Edit route to examine; adding another View link would not establish the intended roster. If a broader link’s Edit permission needs to change, Microsoft’s guidance says it generally cannot simply be switched to View: the link may need to be deleted and recreated. That is a separate decision for the file or site owner after the access review. Microsoft’s permissions guide

Give the owner a file-specific question

A request such as “remove the agency” leaves the owner to guess which account, file and route you mean. Use the address visible for the external user, and identify the file’s actual library or folder. If you only paste a sharing link, the owner still has to determine whether it opens the intended proposal or a similarly named copy.

For Maya’s example, the useful question is whether membership in Project reviewers should grant Edit to this particular proposal. Removing Maya from that group could also affect other project files; deleting the proposal’s View link would address a different route. Describe the unwanted permission on this file before asking the owner to choose a change.

If you cannot see the Finance roster, record “membership not confirmed” instead of guessing that only the displayed group owner can open the file. Keep that unresolved line in the note. Once the responsible owner has answered it, the audit can distinguish an allowed team-wide permission from a grant that needs correction.

Common questions

Can Manage access name every person who might use the file? It can show named people and groups, but an Anyone link does not enumerate its holders. A group name also does not supply a confirmed membership roster; ask its owner for that. Microsoft’s guide to seeing who a file is shared with, Microsoft’s SharePoint sharing guide

Can it show who opened the file? The access panel describes permission routes. Do not use it as evidence of an open or download.

Can a file owner remove inherited site access? Owning the file does not by itself settle a parent-site permission. Give IT or the site owner the file name, its OneDrive or SharePoint location, the account you checked, and the route shown in Access summary so they can review the appropriate parent permission. Microsoft’s permissions guide

Source note: The linked Microsoft support pages were reviewed October 7, 2026. The CSV is a synthetic teaching worksheet; no live tenant trial was recorded.