Want Help With Microsoft 365 Sharing?

iTech Plus manages Microsoft 365 for offices across Polk and Osceola counties, in English and Spanish. We set up guest access, clean up old links and guests, and make sure clients can open what you send them. See our Microsoft 365 management service, book a free IT assessment, or call (321) 221-7117 or email info@itechplus.co.

OneDrive Link Access Denied for Clients? The Fix

Why are clients getting “access denied” on my OneDrive or SharePoint links?

If a client gets OneDrive link access denied on a file you shared with them before, it is because Microsoft is retiring the old way outside people opened files you shared with them. Until now, when you shared a file with a specific person outside your company, they typed in a one-time code sent to their email and they were in. Microsoft is replacing that with guest accounts in your company’s Microsoft 365 directory. Retirement of the old codes began in mid-October 2026 and is expected to finish by the end of November 2026. Once it reaches your account, anyone opening an older link who doesn’t have a guest account gets “access denied”.

The change is described in Microsoft’s Message Center notice MC1243549, last updated on October 1, 2026. The dates have moved several times this year, so articles that say July, August or October 31 are out of date.

Which links break, and which don’t?

Break: links shared with a specific person outside your company, sent before the change reached your account, to someone who never got a guest account.

Keep working: anything shared with people who already have a guest account in your directory.

Keep working: new shares. Since the first phase rolled out, sharing with an outside person creates the guest account automatically.

Not part of this change: links inside your company, and “anyone with the link” links, which never used the one-time code. If your office uses “anyone” links for client documents, that is a bigger problem than this one. Anybody who gets the link, including from a forwarded email, can open the file.

How do I fix it for one client?

Share something with them again. Microsoft’s notice says that when someone in your company shares or re-shares at least one file, folder or site with that outside person, it creates their guest account and restores access to everything previously shared with them. In practice:

Open OneDrive or SharePoint and find the file the client can’t open.

Select Share, enter the client’s email address, and send.

The client opens the new email and signs in. If they don’t have a Microsoft account, they still get a code by email, so for them it looks much the same.

Their old links start working again.

The first time, the client may see a Microsoft screen asking them to accept that your organization can see their name and email address. That screen is genuine, and they need to accept it. Tell them it is coming, because a client who has been warned about phishing may stop there.

What should the person who manages Microsoft 365 do?

Find the people who will be affected. The external sharing reports in the SharePoint admin center list who has been sharing with whom. Clients and vendors with no guest account are the ones who will call.

Create guest accounts ahead of time for clients you share with often, so they never see the error.

Leave email one-time passcode turned on for guests in the Microsoft Entra admin center, under External Identities. Guests without a Microsoft account sign in that way, so turning it off locks them out.

Decide who may invite guests. Staff who share with clients need permission to do it, which Microsoft calls the Guest Inviter role. Everyone else probably doesn’t.

Check that your guest rules allow guests to sign in. If you require multi-factor authentication for guests, make sure your clients can actually complete it.

Is this good or bad for security?

Mostly good. Guest accounts can be listed, reviewed and removed, and your sign-in rules apply to them. The old one-time codes were invisible to your directory. The risk runs the other way: every client you share with now becomes a guest in your Microsoft 365, and most small offices never clean that list. For a tax office or a medical practice, that list is part of who can reach client information, so review it at least once a year and remove anyone who no longer needs access. The FTC Safeguards Rule calls this vendor oversight and access control, and HIPAA calls it access management.

It is also a good moment to set links to expire. A tax return shared in March doesn’t need to stay open forever.

Tax and accounting offices: why this matters right now

Clients go back to last year’s links in the fall, when lenders and schools ask for returns, and again in January to compare. Those are exactly the older links that break. If you have used OneDrive or SharePoint links to deliver returns, re-share with your active clients before the season. Better still, deliver documents through your tax software’s client portal, which keeps a record of what was sent and when.