TL;DR. Emailing a spreadsheet of client data, a signed contract, or a PDF with a Social Security number on it is one of the most common ways small businesses leak protected information. There is a much better answer baked into Microsoft 365: OneDrive secure sharing. With a few clicks you can send a specific person a link that requires their identity to open, expires automatically, optionally requires a password, and can be revoked the moment you change your mind. Here is how to use it correctly — including the gotchas that catch people the first time.

Why “just attach it to the email” is the wrong default

Email was designed in 1982 to move plain text between trusted servers. It was never designed to carry sensitive attachments, and it has not gotten meaningfully better at it since. When you attach a file to an email and hit Send:

• The file is now everywhere. It sits in your Sent folder, the recipient’s Inbox, every server it traversed in transit, every backup of all of those, every device that has cached the message, and any reply chains that quoted it. If you regret it five minutes later, there is no “recall” that actually works.
• You cannot tell who opened it. Read receipts are unreliable and trivially defeated. You have no audit trail.
• You cannot revoke it. If the recipient’s account gets compromised next week, your file is in the attacker’s hands.
• You cannot expire it. Even if the recipient is a temporary contractor whose project ended six months ago, your file still lives in their archive.
• You cannot enforce that the recipient is who you think they are. Anyone with access to the recipient’s email can open the attachment.

For anything containing personally identifiable information (PII) — SSNs, dates of birth, account numbers, driver’s licenses, medical info, financial info, signed contracts — this is the wrong tool. Most compliance regimes (HIPAA, GLBA, PCI, state data-breach laws) treat unencrypted email of PII as a reportable incident if it is ever intercepted.

What OneDrive sharing gives you instead

When you share a file or folder through OneDrive (or SharePoint — same engine), you give the recipient a link. The link itself does nothing without the right credentials and the right permissions. Specifically you get to control:

• Who can use the link. Specific named individuals, anyone in your organization, anyone with the link, or only people who already had access. The default for sensitive sharing should be specific people.
• What they can do. View only, view and edit, or open in “review” mode (suggested edits / comments only). For PII you almost always want view only.
• Block download. The recipient can read the file in the browser but cannot save a local copy. Combined with view-only, this is what you use for files you do not want a copy escaping with.
• Expiration date. The link stops working after a date you choose. We default to 14 or 30 days for most external shares; longer only when there is a real reason.
• Password. An additional password the recipient must type to open the file. Send the password through a different channel (text message, phone call) — not the same email.
• Audit trail. OneDrive logs every open, edit, and download. If something gets out, you can answer the question “who saw it and when?”
• Revoke access at any time. Right-click the file or folder › Manage access › remove the person or delete the link. Done.

Step-by-step: sharing a single file with one external person

1. Right-click the file in OneDrive (web or File Explorer with OneDrive sync) › Share.
2. At the top of the dialog, click the gear / link-settings button. Change Anyone with the link to Specific people.
3. Set Can edit → Can view if the file should be read-only.
4. Tick Block download if the file should not leave the browser.
5. Set an expiration date — default to 14 or 30 days.
6. Optionally set a password. Communicate it through a different channel.
7. Save the link settings, then enter the recipient’s email address and a short message. Click Send. Microsoft will email them the link.

The recipient will be required to verify their identity — either by signing in if they already have a Microsoft 365 or Microsoft account on that email, or by receiving a one-time code at that email address. They cannot just forward the link to a friend and have it work; the link is bound to their identity.

Sharing a folder of files

The same mechanics work on folders. Sharing a folder is the right answer when you have an ongoing relationship and the contents will change — an active client engagement, a tax-document drop folder, a contractor’s deliverables. Tips:

• Use a SharePoint site, not OneDrive, for ongoing folder sharing. If anyone else at your company also needs access — even just for backup — the folder belongs in a SharePoint site (see our SharePoint post). OneDrive is “your” storage; SharePoint is “the team’s.”
• Name the folder for the relationship. “Acme Corp — 2026 audit” rather than “client docs.” You will thank yourself when there are 30 of them.
• Pin the folder to your OneDrive shortcuts. “Add shortcut to OneDrive” from the SharePoint site puts a pointer in your personal OneDrive so you can drag files in without leaving Explorer.
• Audit access quarterly. “Manage access” on the folder shows everyone who has any kind of permission. Remove anyone who should not still be there. Microsoft 365 Access Reviews can automate this for larger orgs.

Sensitivity labels: the upgrade for PII

For files that carry serious PII or business-confidential data, Microsoft 365 sensitivity labels add a second layer that travels with the file. A user (or an automatic policy) attaches a label like Confidential — Client Data; from then on the file is encrypted, watermarked with the recipient’s name, restricted from copy-paste, and tied to a list of authorized people. The protection persists even if the file leaves OneDrive — if a recipient downloads it, opens it on their laptop, then emails it to someone else, the new recipient still has to authenticate as an authorized user before Office will decrypt it.

Sensitivity labels do require a license tier (Microsoft 365 Business Premium or higher) and some up-front policy work. We set this up as part of any compliance-driven engagement. For a small business handling SSNs, financial account numbers, or HIPAA data on a regular basis, the additional cost is well below what a single mishandled file would cost in breach-notification expenses.

The audit trail you actually want

If a file leaks and you have to answer to a regulator, an attorney, or a board, “I emailed it to Bob and that’s all I know” is a much worse answer than:

• Bob received a link on April 14.
• Bob authenticated and opened the file on April 15 at 9:42 AM from IP x.y.z.w.
• The link was set to expire on April 30.
• It expired without further access.
• No download occurred.

That is exactly what OneDrive’s audit log gives you for shared files. Microsoft 365 retains audit data for 90 days by default and longer with E5 / Audit add-on licensing.

Tenant-level settings that actually matter

The defaults that ship with a fresh M365 tenant are too permissive for most regulated work. The settings we tighten on most client tenants:

• External sharing default: New and existing guests, never “Anyone” (which would let any random link recipient open files without authentication).
• Default link type: Specific people, not “Anyone with the link.” This forces a deliberate choice every time.
• Default link permission: View, not Edit.
• Anyone-link expiration: if you do allow Anyone links anywhere, force a maximum expiration of 30 days.
• Domain allow-list / block-list: for highly-regulated customers, restrict external sharing to a defined list of partner domains.
• Re-authentication interval: require external recipients to verify their email every 15 days.

These are tenant-wide settings under SharePoint admin center › Policies › Sharing. They do not block users from doing legitimate work — they just stop the casual “anyone-with-the-link” mistake.

What about password-protected ZIP files?

You will sometimes see a vendor or partner email a password-protected ZIP and text the password. It is better than nothing, but it is meaningfully worse than a OneDrive link:

• The ZIP still lives in everyone’s mailbox forever — you cannot revoke or expire it.
• ZIP encryption is breakable with modern hardware if the password is weak.
• There is no audit trail of who opened it.
• If the recipient’s laptop is compromised, the password is usually right there in the same chat thread.

Use OneDrive sharing instead. The password-protected ZIP is a tool from 2005.

The 60-second checklist for sharing PII externally

1. Put the file in OneDrive (or SharePoint).
2. Right-click › Share › Specific people, Can view, Block download on, Expiration in 14–30 days, Password if it is genuinely sensitive.
3. Send the link. Send the password by text or phone — not in the same email.
4. Note in your records when you shared, with whom, and the expiration date.
5. Once the work is done, revoke the link or delete the share. Do not leave it open “just in case.”

If your team handles PII routinely — tax preparers, healthcare offices, financial advisors, lenders, attorneys, anyone touching customer SSNs or financial data — we recommend turning all of the above into a written policy and training people on it once. We help with that. Drop us a line or call 970-282-8838 if you want to firm up your secure-sharing practices.