When you share OneDrive for Business files with external partners during a project, those links may suddenly show Access Denied when opened, especially during project closeout. This typically happens when the sharing link has expired, the external user’s access has been revoked, or the file has been moved or deleted as part of cleanup processes. This article explains why these access denials occur specifically during project closeout and provides step-by-step methods to diagnose and fix each cause. You will learn how to check link expiration settings, restore deleted files, and re-share content without breaking security policies.
Key Takeaways: Fixing External Sharing Link Access Denied Errors
- OneDrive sharing link expiration settings: Links can be set to expire after a specific number of days — check and adjust the expiration date in the link properties.
- OneDrive recycle bin recovery: Deleted files can be restored from the site collection recycle bin within 93 days, re-enabling the original sharing link.
- SharePoint admin center external sharing controls: Tenant-level policies can block external access entirely; verify that external sharing is allowed for your site or OneDrive.
Why External Sharing Links Fail During Project Closeout
During project closeout, teams often perform cleanup actions that inadvertently break external sharing links. The most common technical causes are:
Expired sharing links. When you create a sharing link in OneDrive, you can set an expiration date. If the link was created with a 30-day expiration during the project, it will stop working after that period. Closeout may occur weeks or months later, so the link expires before the external user tries to open it.
Deleted or moved files. During closeout, files are often archived, moved to a different folder, or deleted. If the original file no longer exists at the path the link points to, the link returns Access Denied because the target resource is missing.
Revoked user permissions. External users may have been removed from the project team or their guest access revoked in Microsoft Entra ID. Once their account is disabled or removed, any sharing link that includes them as a specific recipient will fail.
Tenant-wide policy changes. IT administrators may tighten external sharing policies during or after a project to meet compliance requirements. For example, they might disable Anyone links or require authentication for all external sharing. These policy changes can invalidate previously working links.
Steps to Diagnose and Fix Access Denied on External Sharing Links
- Check the sharing link type and expiration
Open the original file in OneDrive on the web. Click the Share button in the toolbar. In the sharing dialog, look at the link type: Anyone with the link, People in your organization, or Specific people. If the link says Expired next to the date, the link has reached its end date. You must create a new link with an updated expiration or remove the expiration date entirely. - Verify the file still exists at the original location
Navigate to the folder where the file was originally stored. If the file has been moved, the link will not follow it. Use the OneDrive search bar to find the file by name. If the file is missing, check the Recycle bin in OneDrive. Select Recycle bin from the left navigation. If the file is there, select it and click Restore. After restoration, the original sharing link will work again. - Confirm the external user’s account is active
Go to the Microsoft 365 admin center at admin.microsoft.com. Navigate to Users > Active users and search for the external user’s email address. If the account shows Blocked or Deleted, you must re-invite the user as a guest. In OneDrive, click Share on the file, remove the old user, and add them again to generate a new invitation and link. - Review tenant external sharing settings
In the Microsoft 365 admin center, go to Settings > Org settings > Security & privacy > Sharing. Under External sharing, ensure that Allow users to share with external users is turned on. If your admin has set a specific expiration policy for external links, it will apply to all new links. You cannot override a tenant policy — you must work within the allowed settings. - Use the SharePoint admin center for site-level checks
If the file is stored in a SharePoint site associated with OneDrive, go to the SharePoint admin center. Select Active sites, find your site, and click Sharing. Verify that external sharing is set to Anyone or New and existing guests depending on your needs. For OneDrive personal sites, the sharing level is controlled per user in the OneDrive admin center under Sharing. - Generate a new sharing link with appropriate settings
If the original link cannot be recovered, create a fresh link. In OneDrive, select the file and click Share. Choose Specific people and enter the external user’s email. Set an expiration date if required by policy. Copy the new link and send it to the recipient. The old link will stop working once the new one is created.
If OneDrive Still Shows Access Denied After the Main Fix
The file was permanently deleted and the recycle bin was emptied
If the file is not in the OneDrive recycle bin, check the Second-stage recycle bin in SharePoint. Go to the site collection, select Recycle bin from the left menu, and then click Second-stage recycle bin at the bottom. Files deleted from the first recycle bin remain here for up to 93 days. Restore the file from this location to recover the sharing link.
The external user receives a login prompt but cannot authenticate
This occurs when the link type is Specific people and the user is not recognized as a guest in your tenant. Ask the user to sign in with a Microsoft account or a work or school account that matches the email you shared with. If they still cannot authenticate, remove them from the sharing list and add them again. This triggers a new guest invitation in Microsoft Entra ID.
The link works for some users but not others
Check if the link was shared with a group or distribution list. If a user was added to the group after the link was created, they may not inherit access. Re-share the file directly with the individual user. Also verify that the user is not blocked by conditional access policies in Microsoft Entra ID.
Sharing Link Types and Their Behavior During Closeout
| Item | Anyone with the link | Specific people |
|---|---|---|
| Authentication required | No | Yes — Microsoft account or guest login |
| Expiration can be set | Yes, in link settings | Yes, in link settings |
| Affected by user account deletion | No — no user specified | Yes — link fails if user is deleted |
| Affected by file deletion | Yes — file must exist at original path | Yes — file must exist at original path |
| Best for project closeout | Less secure but avoids user authentication issues | More secure but requires active guest accounts |
During project closeout, consider using Anyone with the link with a short expiration date if security policies allow. This eliminates authentication problems for external users who may no longer have active guest accounts.
Now you can diagnose and resolve Access Denied errors on OneDrive external sharing links during project closeout. Check the link expiration first, then verify the file location and user status. For ongoing projects, set sharing link expiration dates to match the project timeline and review tenant policies before cleanup begins. A practical tip: use the Share dialog’s Link settings to apply a password for Anyone links — this adds security without requiring user authentication.