How to Remove External SharePoint and OneDrive Access for Former Employees
Question details
Administrators need a method to identify and bulk-remove external file permissions across SharePoint and OneDrive for a former employee who may retain access via personal or external accounts.
- Product
- SharePoint and OneDrive for Business
- Device & OS
- not provided
- Scenario
- Revoking unauthorized document access for departing employees to ensure organizational data security.
- Observed behavior
- Former employees continue to have access to shared documents, and administrators find it difficult to locate and remove permissions across numerous files without reviewing each document individually.
Ensure you have global or SharePoint administrator permissions in Microsoft 365 before attempting to modify tenant-level sharing settings or running administrative scripts.
Restrict External Sharing at the Tenant Level
This is the most direct method to globally revoke external access if you need to secure the entire environment immediately.
By adjusting the external sharing policies at the tenant level, you can rapidly terminate all external and guest access to SharePoint and OneDrive documents. Note that this affects all external users, not just the former employee.
Log in to the Microsoft 365 admin center and navigate to the SharePoint admin center.
In the left navigation pane, expand 'Policies' and select 'Sharing'.
Drag the external sharing slider down for both SharePoint and OneDrive to 'Only people in your organization'.
Scroll down and click 'Save'. Existing guests and external users typically lose access to shared files within approximately one hour.
Use PowerShell for Targeted Access Removal
Use PowerShell scripting to identify and remove specific external email addresses across all site collections without affecting other guests.
Secure and Manage Your Local Documents with WPS Office
While enterprise cloud permissions require Microsoft 365 administrative tools, managing and securing your local documents is easier with WPS Office. It provides a highly compatible, lightweight, and free environment for editing and encrypting your sensitive files.
- 1. Download and Install: Download WPS Office from the official website and follow the simple installation wizard.
- 2. Open Your Office Files: Launch WPS Office and open your existing Microsoft Office documents without worrying about formatting issues.
- 3. Apply Password Protection: Navigate to the 'Menu', select 'Document Encryption', and set a password to securely lock your local files from former employees or unauthorized users.
Frequently Asked Questions
Can I revoke access to a single file shared via OneDrive?
Yes. Navigate to the specific file in your OneDrive, click the 'Share' icon, select 'Manage Access', and locate the external user. Click on their name or permissions and select 'Stop sharing' or 'Remove' to revoke their access to that individual file.
How long does it take for tenant-level sharing restrictions to apply?
When an administrator changes the external sharing settings at the tenant level to 'Only people in your organization', external guests typically lose access to their previously shared files within approximately one hour.
Is there a built-in admin dashboard to bulk-remove a specific guest user's file access?
No, Microsoft 365 currently lacks a native user interface feature that allows administrators to search across all SharePoint sites and OneDrive accounts to bulk-remove permissions for a specific external email address. Administrators must rely on custom PowerShell solutions.
