Permission & Access Issues

How to Create a Secure Upload Folder for External Users in OneDrive

Kushani Nimanthika Oct 22, 2026 868 views

Question details

The user needs to set up a secure OneDrive upload location for external users to submit sensitive files, while strictly limiting view access to specific internal users and ensuring HIPAA compliance.

How to Create a Secure Upload Folder for External Users in OneDrive

Product: Microsoft OneDrive
Device & OS: not provided
Scenario: Creating an external file collection portal for sensitive data with restricted internal permissions.
Observed behavior: Seeking a sharing and permission structure that allows external uploads without exposing existing files to uploaders, while restricting internal viewing for compliance purposes.

Before you start

Verify that your Microsoft 365 tenant is properly configured for HIPAA compliance, which includes having a signed Business Associate Agreement (BAA) with Microsoft and enabling audit logging before handling protected health information (PHI).

Solution 1Recommended

Use the Request Files Feature for External Users

The safest method to collect files from external parties without granting them access to view folder contents is using OneDrive's built-in file request feature.

By utilizing the 'Request files' feature, you create a special link that only allows users to upload files. External users cannot view, edit, or download any existing files in that folder, ensuring complete privacy between different uploaders.

Select the target folder

Log in to your OneDrive on the web, locate the dedicated folder you want to use for external uploads, and select it by clicking the circle checkmark beside it.

Initiate file request

Click on 'Request files' located in the top navigation menu. If you do not see it, click the three-dot menu (...) to find the option.

Configure the request details

Enter a descriptive name for the files you are requesting (e.g., 'Patient Records Upload') so the external users know what the link is for, and click 'Next'.

Share the secure link

Click 'Copy link' to copy the generated URL. You can now securely email this link to your external users for file submission.

Use the Request Files Feature for External Users

Feature Availability: The 'Request files' feature requires 'Anyone' links to be enabled at the tenant level by your Microsoft 365 administrator.

Solution 2

Stop Permission Inheritance to Restrict Internal Access

To ensure that only specific internal users can view the highly sensitive uploaded files, you must break the folder's permission inheritance.

Free Microsoft Office alternative

Edit and Manage Sensitive Documents with WPS Office

While OneDrive provides a secure environment for collecting files, you need a reliable and safe office suite to review those sensitive documents. WPS Office is a lightweight, secure, and highly compatible alternative to Microsoft Office.

Fully compatible with Microsoft Word, Excel, and PowerPoint document formats.Built-in document encryption and password protection to safeguard sensitive files.Lightweight architecture ensures fast loading of large external files.Seamless integration with cloud environments for efficient document management.

Frequently Asked Questions

Is a single OneDrive file request link secure enough for HIPAA-related data?

While the link itself utilizes HTTPS encryption and strictly limits the user to upload-only capabilities (preventing unauthorized viewing), true HIPAA compliance requires organizational measures. Your Microsoft 365 tenant must be properly configured, audit logging must be active, and a Business Associate Agreement (BAA) must be executed with Microsoft before handling such data.

Can external users see what other people have uploaded to the same folder?

No. When utilizing the 'Request files' feature, the external user interface only provides an upload button. They cannot view the folder contents, ensuring that uploads from different external parties remain completely isolated and private.

Why is the 'Request files' option missing from my OneDrive?

This option may not be visible if your IT administrator has disabled 'Anyone' sharing links at the tenant or site level in Microsoft 365. It is also only available for OneDrive for Business and SharePoint, not personal OneDrive accounts.

Document & File Issues