Who Can Still Open Your Business Files?

01

1. Start With The Work, Not A Blanket Lockdown

Pick a manageable part of the business: a current client-project folder, a supplier collaboration area or the documents used for quoting and job delivery. Write down what that area is for, who needs it today and who can approve changes. Include the external accountant, contractor or client where their work still requires access.

Begin with a read-only inventory. Do not remove everyone and wait for complaints to discover what mattered. A shared folder may support a customer deadline, a recurring report or an application integration. Ask the business owner about those dependencies before changing its audience or moving its contents.

Keep the review record in an appropriately restricted business location. File names, recipient addresses and collaboration details can themselves be sensitive. A public checklist is a planning aid, not a place to upload your permission inventory.

Separate three questions:

• Who needs to see it? The current approved audience, not everyone who once worked on the project.
• Who needs to change it? A person reading an approved quote may not need to edit the working template.
• Who decides? A named business owner who understands the information and the work it supports.

02

2. Record The Different Ways Someone Can Get In

A file can be accessible through more than one arrangement. In Microsoft 365, inspect links, direct access and relevant folder or site permissions rather than stopping at the most recent invitation. Microsoft's sharing and permissions guidance distinguishes those routes and explains that inherited access may need to be managed at its parent.

Use this review register for each selected area. It is an original planning worksheet: adapt it to your business, without treating it as a complete security audit.

Do not store passwords, recovery codes or live unrestricted links in a broadly shared register. Reference the secured business location instead. Record an unresolved permission path as unresolved; guessing that it has disappeared is not a completed check.

03

3. Check Link Audience And Folder Inheritance

In OneDrive and SharePoint, an Anyone link can be used by whoever receives it without authenticating. A People in your organization link is limited to authenticated members of that organisation, but can circulate within that audience. A Specific people link works for the named recipients. These are different choices, not interchangeable descriptions of a private invitation. See Microsoft's explanation of shareable links.

In Google Drive, Anyone with the link permits access without signing in, while Restricted permits people who already have access. Restricted does not mean “only the owner.” Review the actual people and permissions, not just that label. See Google's file-sharing guidance.

Also inspect the parent folder. Google documents that folder permissions are inherited by its contents; reducing a file's setting does not override a person's higher parent-folder access. Where a subset needs tighter access, review the supported limited-access-folder arrangement with the authorised owner. Google's folder-sharing guidance explains this relationship and group-based access.

A practical example: a supplier only needs the final drawings for this month's job. The business owner can decide whether that audience should reach the whole project area, or a separately controlled deliverables area. That decision comes before the technician chooses the supported configuration. The example is illustrative, not a claim about a particular client's setup.

04

4. Make Approved Changes Without Stopping Collaboration

Turn the findings into a small change list. “Remove the old supplier's direct permission from the completed project” is more useful than “make everything secure.” Record the intended outcome, owner approval, likely dependencies and a way to recover from an accidental interruption.

Schedule changes around the people who use the files. Explain any replacement access route to approved collaborators so a permission cleanup does not become a rush of confusing access requests. Do not send sensitive material to a new recipient merely to test whether sharing works.

Be careful with wide scopes. A parent-folder change or a group-membership change can affect more than the item being reviewed. Confirm the wider impact before proceeding. If an application or automated job depends on the access, include its responsible administrator in the approval and verification process.

Do not use account deletion, mass revocation or file moves as shortcuts for understanding permissions. If access looks suspicious or confidential material may have been exposed, stop treating it as a routine tidy-up and arrange appropriate incident help. This checklist does not establish whether a breach occurred or replace specialist incident handling.

Ultra IT can help map the work and coordinate the changes through Microsoft 365 support or Google Workspace support, with the scope agreed for your environment.

05

5. Verify Both Access And The Work It Supports

Checking a setting is one part of verification. Confirm the intended business result through an authorised test, using approved accounts or non-sensitive test material. Never try to obtain another person's credentials or access information you are not authorised to inspect.

If the result differs from the plan, stop and reconcile the permission path. Keep a concise record of the approved scope, actual change, verification and unresolved items. A technician's administrator view is not necessarily the same experience as the intended recipient's account.

These four hypothetical checks show what a useful outcome record can look like:

• The approved colleague: can open the required working file and perform the editing task their role needs.
• The approved external collaborator: can reach the agreed deliverable without receiving wider access simply for convenience.
• The retired sharing route: no longer grants access through that route; other permissions are separately checked rather than assumed closed.
• The dependent workflow: the scheduled report or business application still performs its agreed task after the change.

06

6. Give The Review An Owner And A Next Date

An access review becomes useful ongoing management when someone owns the follow-up. Choose a cadence that fits the sensitivity of the information and the pace of staff, client and supplier changes. Review sooner when a project closes, a supplier relationship changes or a folder's audience expands; there is no single interval that suits every business.

For a departing employee, use a wider Microsoft 365 offboarding checklist as well. Shared-file review is not a substitute for account, device, email and application handover.

Ultra IT provides local, developer-led support for Sunshine Coast and Gympie businesses. We can help turn unclear access into a documented review and coordinate separately scoped application work where a business system is involved. An initial discussion establishes the requirements; it is not a promise of a particular security outcome or a completed audit.

Discuss a file-sharing review with Ultra IT. Let us know whether you use Microsoft 365 or Google Workspace and what your team needs to keep doing.

Prepare these details for a support discussion:

• The platform and the folder or collaboration area involved, described without exposing its contents.
• The business task that needs to keep working.
• The owner who can approve access decisions.
• The intended staff and external audience, shared through an agreed secure method when necessary.
• Any application dependency, deadline or previous access problem.
• Whether you need a focused review or ongoing ownership of the process.