If a client, accountant or contractor has just told you “I can't open the link you sent”, and the same link worked last month, this is probably why. Microsoft is changing how people outside your business get into SharePoint and OneDrive files, and the switch is happening right now. The fix is quick once you know what's going on.
What's changing?
Until now, when you shared a file with someone outside your business using a “Specific people” link, SharePoint could email them a one-time code to type in. No account needed. Microsoft calls this SharePoint one-time passcode, and it's being retired.
- —Since May–July 2026, new sharing already works differently: when you share with an outsider, Microsoft quietly creates a guest account for them in your Microsoft 365 (technically a Microsoft Entra B2B guest).
- —From mid-October to the end of November 2026, the old one-time codes stop working, business by business. Microsoft isn't making exceptions.
- —After that, anyone who opened your files with an old-style code, and doesn't have a guest account yet, gets “access denied” on links you shared before.
People who already have a guest account in your Microsoft 365 aren't affected. Neither is sharing inside your own team.
Who's most likely to be caught out
- —Businesses that send clients their documents through SharePoint or OneDrive links: accountants, law firms, consultants, agencies, financial advisers.
- —Teams that share folders with contractors, freelancers or suppliers, and manufacturers sharing data sheets and certificates with distributors.
- —Anyone who shared links a while ago that outsiders still use, like a client folder they open every month.
The quick fix (no admin needed)
This is the part most people don't know: you don't have to reshare every file. If someone has lost access, share any one file, folder or site with them again from SharePoint or OneDrive. That creates their guest account, and Microsoft restores their access to everything you shared with them before.
- —Open SharePoint or OneDrive and select a file or folder they should have.
- —Select Share and add their email address, the same one you originally shared with.
- —Send it. They'll get an invitation, sign in once, and their old links work again.
When they open it, they sign in with their work or Microsoft account if they have one. If they don't, Microsoft can still email them a code. It just comes through their new guest account now, so clients without Microsoft 365 can still get in.
Better: fix it before your clients notice
If you have a Microsoft 365 admin (or you are the admin), a little preparation now saves a lot of awkward emails later:
- —Find out who you share with. In each important SharePoint site, go to Settings → Site usage and run the report on content shared with external users. Your key clients and contractors will be on it.
- —Create guest accounts in advance for the people who matter most. In the Microsoft Entra admin centre, go to Users → New user → Invite external user and use the email address you originally shared with. A matching guest account means they keep access without resharing anything.
- —Check that your settings allow guests. In Entra's External collaboration settings, make sure the people who share with clients are allowed to invite guests. In the SharePoint admin centre, check that sharing allows “New and existing guests” where you need it.
- —Leave email one-time passcodes switched on for guests in Entra, so outsiders without a Microsoft account can still sign in with a code.
- —Tell your team, so they know what “I can't open your link” means and how to fix it in a minute.
Can't access SharePoint for another reason? Quick checks
If the problem isn't an outside person opening your link, run through these. They cover most “can't access SharePoint” messages inside a business:
- —Wrong account. If someone has a personal Microsoft account and a work account with the same email address, SharePoint may pick the wrong one. Open the link in a private browser window and sign in with the work account.
- —No permission yet. “You need permission to access this item” means the site or file isn't shared with them. Use Request access, or ask the site owner to add them to the right group rather than sharing files one by one.
- —Access was removed. If someone was taken out of a group or the site's sharing was tightened, older links stop working for them. A site owner can check under Settings → Site permissions.
- —The link has expired or was changed. Links can have an expiry date, and with the new Share window the owner can change who a link works for after sending it. Ask for a fresh link.
- —Sign-in is being blocked. Prompts about multi-factor authentication, an unfamiliar device or location usually come from your organisation's security settings. Your Microsoft 365 admin can see why in the sign-in logs.
Also new this month: one main link per file
Between mid-September and late October 2026, Microsoft is also rolling out a new Share window in OneDrive and SharePoint. Each file and folder now has one main link (Microsoft calls it the “hero link”), and you can change who it works for after you've sent it. Your older links keep working and move under Other links.
By default the main link only works for people you've added, which is the safe choice. Before you send a link to a client, glance at who it's set to work for, so it neither fails for them nor works for the whole world.
A message you can send your clients
If you share files with clients regularly, a short heads-up avoids confusion. Feel free to copy this:
“Microsoft is changing how secure file sharing works this month. If a link from us asks you to sign in or says access denied, just let us know and we'll send you a fresh invitation. It takes a minute, and you'll keep access to everything we've shared with you.”
Use it as a chance to tidy up
Guest accounts are actually an improvement: every outsider now shows up in one place, follows your security rules, and can be removed in one step when a project ends. Once you've sorted access, take ten minutes to remove guests who no longer need it and old links nobody uses. It's the same housekeeping that matters before you switch on Copilot, and it's part of my Microsoft 365 setup checklist (step 8: sensible sharing settings).
If your sharing has grown messy over the years, or you'd rather not touch the admin settings yourself, my Microsoft 365 setup service covers exactly this.
